|
decompiler
1.0.0
|
Container for data structures associated with a single function. More...
#include <funcdata.hh>
Public Member Functions | |
| Funcdata (const string &nm, Scope *conf, const Address &addr, FunctionSymbol *sym, int4 sz=0) | |
| Constructor. More... | |
| ~Funcdata (void) | |
| Destructor. | |
| const string & | getName (void) const |
| Get the function's local symbol name. | |
| const Address & | getAddress (void) const |
| Get the entry point address. | |
| int4 | getSize (void) const |
| Get the function body size in bytes. | |
| Architecture * | getArch (void) const |
| Get the program/architecture owning this function. | |
| FunctionSymbol * | getSymbol (void) const |
| Return the symbol associated with this function. | |
| bool | isHighOn (void) const |
| Are high-level variables assigned to Varnodes. | |
| bool | isProcStarted (void) const |
| Has processing of the function started. | |
| bool | isProcComplete (void) const |
| Is processing of the function complete. | |
| bool | hasUnreachableBlocks (void) const |
| Did this function exhibit unreachable code. | |
| bool | isTypeRecoveryOn (void) const |
| Has data-type recovery processes started. | |
| bool | hasNoCode (void) const |
| Return true if this function has no code body. | |
| void | setNoCode (bool val) |
| Toggle whether this has a body. | |
| void | setLanedRegGenerated (void) |
| Mark that laned registers have been collected. | |
| void | setJumptableRecovery (bool val) |
| Toggle whether this is being used for jump-table recovery. More... | |
| bool | isJumptableRecoveryOn (void) const |
| Is this used for jump-table recovery. | |
| void | setDoublePrecisRecovery (bool val) |
| Toggle whether double precision analysis is used. More... | |
| bool | isDoublePrecisOn (void) const |
| Is double precision analysis enabled. | |
| bool | hasNoStructBlocks (void) const |
| Return true if no block structuring was performed. | |
| void | clear (void) |
| Clear out old disassembly. | |
| void | warning (const string &txt, const Address &ad) const |
| Add a warning comment in the function body. More... | |
| void | warningHeader (const string &txt) const |
| Add a warning comment as part of the function header. More... | |
| void | startProcessing (void) |
| Start processing for this function. More... | |
| void | stopProcessing (void) |
| Mark that processing has completed for this function. | |
| bool | startTypeRecovery (void) |
| Mark that data-type analysis has started. | |
| void | startCastPhase (void) |
| Start the cast insertion phase. | |
| uint4 | getCastPhaseIndex (void) const |
| Get creation index at the start of cast insertion. | |
| uint4 | getHighLevelIndex (void) const |
| Get creation index at the start of HighVariable creation. | |
| void | startCleanUp (void) |
| Start clean-up phase. | |
| uint4 | getCleanUpIndex (void) const |
| Get creation index at the start of clean-up phase. | |
| void | followFlow (const Address &baddr, const Address &eadddr) |
| Generate raw p-code for the function. More... | |
| void | truncatedFlow (const Funcdata *fd, const FlowInfo *flow) |
| Generate a clone with truncated control-flow given a partial function. More... | |
| bool | inlineFlow (Funcdata *inlinefd, FlowInfo &flow, PcodeOp *callop) |
| In-line the p-code from another function into this function. More... | |
| void | overrideFlow (const Address &addr, uint4 type) |
| Override the control-flow p-code for a particular instruction. More... | |
| void | doLiveInject (InjectPayload *payload, const Address &addr, BlockBasic *bl, list< PcodeOp * >::iterator pos) |
| Inject p-code from a payload into this live function. More... | |
| void | printRaw (ostream &s) const |
| Print raw p-code op descriptions to a stream. More... | |
| void | printVarnodeTree (ostream &s) const |
| Print a description of all Varnodes to a stream. More... | |
| void | printBlockTree (ostream &s) const |
| Print a description of control-flow structuring to a stream. More... | |
| void | printLocalRange (ostream &s) const |
| Print description of memory ranges associated with local scopes. More... | |
| void | saveXml (ostream &s, uint8 id, bool savetree) const |
| Emit an XML description of this function to stream. More... | |
| uint8 | restoreXml (const Element *el) |
| Restore the state of this function from an XML description. More... | |
| void | saveXmlJumpTable (ostream &s) const |
| Emit an XML description of jump-tables to stream. More... | |
| void | restoreXmlJumpTable (const Element *el) |
| Restore jump-tables from an XML description. More... | |
| void | saveXmlTree (ostream &s) const |
| Save an XML description of the p-code tree to stream. More... | |
| void | saveXmlHigh (ostream &s) const |
| Save an XML description of all HighVariables to stream. More... | |
| Override & | getOverride (void) |
| Get the Override object for this function. | |
| void | setRestartPending (bool val) |
| Toggle whether analysis needs to be restarted for this function. More... | |
| bool | hasRestartPending (void) const |
| Does this function need to restart its analysis. More... | |
| bool | hasUnimplemented (void) const |
| Does this function have instructions marked as unimplemented. More... | |
| bool | hasBadData (void) const |
| Does this function flow into bad data. | |
| void | spacebase (void) |
| Mark registers that map to a virtual address space. More... | |
| Varnode * | newSpacebasePtr (AddrSpace *id) |
| Construct a new spacebase register for a given address space. More... | |
| Varnode * | findSpacebaseInput (AddrSpace *id) const |
| void | spacebaseConstant (PcodeOp *op, int4 slot, SymbolEntry *entry, const Address &rampoint, uintb origval, int4 origsize) |
| Convert a constant pointer into a ram CPUI_PTRSUB. More... | |
| int4 | getHeritagePass (void) const |
| Get overall count of heritage passes. | |
| int4 | numHeritagePasses (AddrSpace *spc) |
| Get the number of heritage passes performed for the given address space. More... | |
| void | seenDeadcode (AddrSpace *spc) |
| Mark that dead Varnodes have been seen in a specific address space. More... | |
| void | setDeadCodeDelay (AddrSpace *spc, int4 delay) |
| Set a delay before removing dead code for a specific address space. More... | |
| bool | deadRemovalAllowed (AddrSpace *spc) const |
| Check if dead code removal is allowed for a specific address space. More... | |
| bool | deadRemovalAllowedSeen (AddrSpace *spc) |
| Check if dead Varnodes have been removed for a specific address space. More... | |
| bool | isHeritaged (Varnode *vn) |
| Check if a specific Varnode has been linked in fully to the syntax tree (SSA) More... | |
| const list< LoadGuard > & | getLoadGuards (void) const |
| Get the list of guarded LOADs. | |
| const list< LoadGuard > & | getStoreGuards (void) const |
| Get the list of guarded STOREs. | |
| const LoadGuard * | getStoreGuard (PcodeOp *op) const |
| Get LoadGuard associated with STORE op. | |
| int4 | numCalls (void) const |
| Get the number of calls made by this function. | |
| FuncCallSpecs * | getCallSpecs (int4 i) const |
| Get the i-th call specification. | |
| FuncCallSpecs * | getCallSpecs (const PcodeOp *op) const |
| Get the call specification associated with a CALL op. | |
| void | updateOpFromSpec (FuncCallSpecs *fc) |
| int4 | fillinExtrapop (void) |
| Recover and return the extrapop for this function. More... | |
| int4 | numVarnodes (void) const |
| Get the total number of Varnodes. | |
| Varnode * | newVarnodeOut (int4 s, const Address &m, PcodeOp *op) |
| Create a new output Varnode. More... | |
| Varnode * | newUniqueOut (int4 s, PcodeOp *op) |
| Create a new temporary output Varnode. More... | |
| Varnode * | newVarnode (int4 s, const Address &m, Datatype *ct=(Datatype *) 0) |
| Create a new unattached Varnode object. More... | |
| Varnode * | newConstant (int4 s, uintb constant_val) |
| Create a new constant Varnode. More... | |
| Varnode * | newVarnode (int4 s, AddrSpace *base, uintb off) |
| Create a new Varnode given an address space and offset. More... | |
| Varnode * | newVarnodeIop (PcodeOp *op) |
| Create a PcodeOp annotation Varnode. More... | |
| Varnode * | newVarnodeSpace (AddrSpace *spc) |
| Create a constant Varnode referring to an address space. More... | |
| Varnode * | newVarnodeCallSpecs (FuncCallSpecs *fc) |
| Create a call specification annotation Varnode. More... | |
| Varnode * | newUnique (int4 s, Datatype *ct=(Datatype *) 0) |
| Create a new temporary Varnode. More... | |
| Varnode * | newCodeRef (const Address &m) |
| Create a code address annotation Varnode. More... | |
| Varnode * | setInputVarnode (Varnode *vn) |
| Mark a Varnode as an input to the function. More... | |
| void | adjustInputVarnodes (const Address &addr, int4 size) |
| Adjust input Varnodes contained in the given range. More... | |
| void | deleteVarnode (Varnode *vn) |
| Delete the given varnode. | |
| Address | findDisjointCover (Varnode *vn, int4 &sz) |
| Find range covering given Varnode and any intersecting Varnodes. More... | |
| Varnode * | findCoveredInput (int4 s, const Address &loc) const |
| Find the first input Varnode covered by the given range. More... | |
| Varnode * | findCoveringInput (int4 s, const Address &loc) const |
| Find the input Varnode that contains the given range. More... | |
| Varnode * | findVarnodeInput (int4 s, const Address &loc) const |
| Find the input Varnode with the given size and storage address. More... | |
| Varnode * | findVarnodeWritten (int4 s, const Address &loc, const Address &pc, uintm uniq=~((uintm) 0)) const |
| Find a defined Varnode via its storage address and its definition address. More... | |
| VarnodeLocSet::const_iterator | beginLoc (void) const |
| Start of all Varnodes sorted by storage. | |
| VarnodeLocSet::const_iterator | endLoc (void) const |
| End of all Varnodes sorted by storage. | |
| VarnodeLocSet::const_iterator | beginLoc (AddrSpace *spaceid) const |
| Start of Varnodes stored in a given address space. | |
| VarnodeLocSet::const_iterator | endLoc (AddrSpace *spaceid) const |
| End of Varnodes stored in a given address space. | |
| VarnodeLocSet::const_iterator | beginLoc (const Address &addr) const |
| Start of Varnodes at a storage address. | |
| VarnodeLocSet::const_iterator | endLoc (const Address &addr) const |
| End of Varnodes at a storage address. | |
| VarnodeLocSet::const_iterator | beginLoc (int4 s, const Address &addr) const |
| Start of Varnodes with given storage. | |
| VarnodeLocSet::const_iterator | endLoc (int4 s, const Address &addr) const |
| End of Varnodes with given storage. | |
| VarnodeLocSet::const_iterator | beginLoc (int4 s, const Address &addr, uint4 fl) const |
| Start of Varnodes matching storage and properties. | |
| VarnodeLocSet::const_iterator | endLoc (int4 s, const Address &addr, uint4 fl) const |
| End of Varnodes matching storage and properties. | |
| VarnodeLocSet::const_iterator | beginLoc (int4 s, const Address &addr, const Address &pc, uintm uniq=~((uintm) 0)) const |
| Start of Varnodes matching storage and definition address. | |
| VarnodeLocSet::const_iterator | endLoc (int4 s, const Address &addr, const Address &pc, uintm uniq=~((uintm) 0)) const |
| End of Varnodes matching storage and definition address. | |
| VarnodeDefSet::const_iterator | beginDef (void) const |
| Start of all Varnodes sorted by definition address. | |
| VarnodeDefSet::const_iterator | endDef (void) const |
| End of all Varnodes sorted by definition address. | |
| VarnodeDefSet::const_iterator | beginDef (uint4 fl) const |
| Start of Varnodes with a given definition property. | |
| VarnodeDefSet::const_iterator | endDef (uint4 fl) const |
| End of Varnodes with a given definition property. | |
| VarnodeDefSet::const_iterator | beginDef (uint4 fl, const Address &addr) const |
| Start of (input or free) Varnodes at a given storage address. | |
| VarnodeDefSet::const_iterator | endDef (uint4 fl, const Address &addr) const |
| End of (input or free) Varnodes at a given storage address. | |
| void | checkForLanedRegister (int4 size, const Address &addr) |
| Check for a potential laned register. More... | |
| map< VarnodeData, const LanedRegister * >::const_iterator | beginLaneAccess (void) const |
| Beginning iterator over laned accesses. | |
| map< VarnodeData, const LanedRegister * >::const_iterator | endLaneAccess (void) const |
| Ending iterator over laned accesses. | |
| void | clearLanedAccessMap (void) |
| Clear records from the laned access list. | |
| HighVariable * | findHigh (const string &name) const |
| Find a high-level variable by name. More... | |
| void | mapGlobals (void) |
| Make sure there is a Symbol entry for all global Varnodes. More... | |
| bool | checkCallDoubleUse (const PcodeOp *opmatch, const PcodeOp *op, const Varnode *vn, const ParamTrial &trial) const |
| Test for legitimate double use of a parameter trial. More... | |
| bool | onlyOpUse (const Varnode *invn, const PcodeOp *opmatch, const ParamTrial &trial) const |
| Test if the given Varnode seems to only be used by a CALL. More... | |
| bool | ancestorOpUse (int4 maxlevel, const Varnode *invn, const PcodeOp *op, ParamTrial &trial) const |
| Test if the given trial Varnode is likely only used for parameter passing. More... | |
| bool | syncVarnodesWithSymbols (const ScopeLocal *lm, bool typesyes) |
| Update Varnode properties based on (new) Symbol information. More... | |
| void | transferVarnodeProperties (Varnode *vn, Varnode *newVn, int4 lsbOffset) |
| Copy properties from an existing Varnode to a new Varnode. More... | |
| bool | fillinReadOnly (Varnode *vn) |
| Replace the given Varnode with its (constant) value in the load image. More... | |
| bool | replaceVolatile (Varnode *vn) |
| Replace accesses of the given Varnode with volatile operations. More... | |
| void | markIndirectOnly (void) |
| Mark illegal input Varnodes used only in INDIRECTs. More... | |
| void | totalReplace (Varnode *vn, Varnode *newvn) |
| Replace all read references to the first Varnode with a second Varnode. More... | |
| void | totalReplaceConstant (Varnode *vn, uintb val) |
| Replace every read reference of the given Varnode with a constant value. More... | |
| ScopeLocal * | getScopeLocal (void) |
| Get the local function scope. | |
| const ScopeLocal * | getScopeLocal (void) const |
| Get the local function scope. | |
| FuncProto & | getFuncProto (void) |
| Get the function's prototype object. | |
| const FuncProto & | getFuncProto (void) const |
| Get the function's prototype object. | |
| void | initActiveOutput (void) |
| void | clearActiveOutput (void) |
| Clear any analysis of the function's return prototype. | |
| ParamActive * | getActiveOutput (void) const |
| Get the return prototype recovery object. | |
| void | setHighLevel (void) |
| Turn on HighVariable objects for all Varnodes. | |
| void | clearDeadVarnodes (void) |
| Delete any dead Varnodes. More... | |
| void | calcNZMask (void) |
| Calculate non-zero masks for all Varnodes. More... | |
| void | clearDeadOps (void) |
| Delete any dead PcodeOps. | |
| void | clearSymbolLinks (HighVariable *high) |
| Clear Symbols attached to Varnodes in the given HighVariable. More... | |
| void | remapVarnode (Varnode *vn, Symbol *sym, const Address &usepoint) |
| Remap a Symbol to a given Varnode using a static mapping. More... | |
| void | remapDynamicVarnode (Varnode *vn, Symbol *sym, const Address &usepoint, uint8 hash) |
| Remap a Symbol to a given Varnode using a new dynamic mapping. More... | |
| Symbol * | linkSymbol (Varnode *vn) |
| Find or create Symbol associated with given Varnode. More... | |
| Symbol * | linkSymbolReference (Varnode *vn) |
| Discover and attach Symbol to a constant reference. More... | |
| Varnode * | findLinkedVarnode (SymbolEntry *entry) const |
| Find a Varnode matching the given Symbol mapping. More... | |
| void | findLinkedVarnodes (SymbolEntry *entry, vector< Varnode * > &res) const |
| Find Varnodes that map to the given SymbolEntry. More... | |
| void | buildDynamicSymbol (Varnode *vn) |
| Build a dynamic Symbol associated with the given Varnode. More... | |
| bool | attemptDynamicMapping (SymbolEntry *entry, DynamicHash &dhash) |
| Map properties of a dynamic symbol to a Varnode. More... | |
| bool | attemptDynamicMappingLate (SymbolEntry *entry, DynamicHash &dhash) |
| Map the name of a dynamic symbol to a Varnode. More... | |
| Merge & | getMerge (void) |
| Get the Merge object for this function. | |
| PcodeOp * | newOp (int4 inputs, const Address &pc) |
| PcodeOp * | newOp (int4 inputs, const SeqNum &sq) |
| Allocate a new PcodeOp with Address. More... | |
| PcodeOp * | newOpBefore (PcodeOp *follow, OpCode opc, Varnode *in1, Varnode *in2, Varnode *in3=(Varnode *) 0) |
| Allocate a new PcodeOp with sequence number. More... | |
| PcodeOp * | cloneOp (const PcodeOp *op, const SeqNum &seq) |
| PcodeOp * | getFirstReturnOp (void) const |
| Clone a PcodeOp into this function. More... | |
| PcodeOp * | newIndirectOp (PcodeOp *indeffect, const Address &addr, int4 size, uint4 extraFlags) |
| Find a representative CPUI_RETURN op for this function. More... | |
| PcodeOp * | newIndirectCreation (PcodeOp *indeffect, const Address &addr, int4 size, bool possibleout) |
| Build a CPUI_INDIRECT op that indirectly creates a Varnode. More... | |
| void | markIndirectCreation (PcodeOp *indop, bool possibleOutput) |
| Convert CPUI_INDIRECT into an indirect creation. More... | |
| PcodeOp * | findOp (const SeqNum &sq) |
| Find PcodeOp with given sequence number. | |
| void | opInsertBefore (PcodeOp *op, PcodeOp *follow) |
| Insert given PcodeOp before a specific op. More... | |
| void | opInsertAfter (PcodeOp *op, PcodeOp *prev) |
| Insert given PcodeOp after a specific op. More... | |
| void | opInsertBegin (PcodeOp *op, BlockBasic *bl) |
| Insert given PcodeOp at the beginning of a basic block. More... | |
| void | opInsertEnd (PcodeOp *op, BlockBasic *bl) |
| Insert given PcodeOp at the end of a basic block. More... | |
| void | opDeadInsertAfter (PcodeOp *op, PcodeOp *prev) |
| Moved given PcodeOp to specified point in the dead list. | |
| void | opHeritage (void) |
| Perform an entire heritage pass linking Varnode reads to writes. | |
| void | opSetOpcode (PcodeOp *op, OpCode opc) |
| Set the op-code for a specific PcodeOp. More... | |
| void | opMarkHalt (PcodeOp *op, uint4 flag) |
| Mark given CPUI_RETURN op as a special halt. More... | |
| void | opSetOutput (PcodeOp *op, Varnode *vn) |
| Set a specific output Varnode for the given PcodeOp. More... | |
| void | opUnsetOutput (PcodeOp *op) |
| Remove output Varnode from the given PcodeOp. More... | |
| void | opSetInput (PcodeOp *op, Varnode *vn, int4 slot) |
| Set a specific input operand for the given PcodeOp. More... | |
| void | opSwapInput (PcodeOp *op, int4 slot1, int4 slot2) |
| Swap two input operands in the given PcodeOp. More... | |
| void | opUnsetInput (PcodeOp *op, int4 slot) |
| Clear an input operand slot for the given PcodeOp. More... | |
| void | opInsert (PcodeOp *op, BlockBasic *bl, list< PcodeOp * >::iterator iter) |
| Insert the given PcodeOp at specific point in a basic block. More... | |
| void | opUninsert (PcodeOp *op) |
| Remove the given PcodeOp from its basic block. More... | |
| void | opUnlink (PcodeOp *op) |
| Unset inputs/output and remove given PcodeOP from its basic block. More... | |
| void | opDestroy (PcodeOp *op) |
| Remove given PcodeOp and destroy its Varnode operands. More... | |
| void | opDestroyRaw (PcodeOp *op) |
| Remove the given raw PcodeOp. More... | |
| void | opDeadAndGone (PcodeOp *op) |
| Free resources for the given dead PcodeOp. | |
| void | opSetAllInput (PcodeOp *op, const vector< Varnode * > &vvec) |
| Set all input Varnodes for the given PcodeOp simultaneously. More... | |
| void | opRemoveInput (PcodeOp *op, int4 slot) |
| Remove a specific input slot for the given PcodeOp. More... | |
| void | opInsertInput (PcodeOp *op, Varnode *vn, int4 slot) |
| Insert a new Varnode into the operand list for the given PcodeOp. More... | |
| void | opMarkStartBasic (PcodeOp *op) |
| Mark PcodeOp as starting a basic block. | |
| void | opMarkStartInstruction (PcodeOp *op) |
| Mark PcodeOp as starting its instruction. | |
| void | opMarkNonPrinting (PcodeOp *op) |
| Mark PcodeOp as not being printed. | |
| void | opMarkSpecialPrint (PcodeOp *op) |
| Mark PcodeOp as needing special printing. | |
| void | opMarkNoCollapse (PcodeOp *op) |
| Mark PcodeOp as not collapsible. | |
| void | opMarkCpoolTransformed (PcodeOp *op) |
| Mark cpool record was visited. | |
| void | opMarkCalculatedBool (PcodeOp *op) |
| Mark PcodeOp as having boolean output. | |
| void | opMarkSpacebasePtr (PcodeOp *op) |
| Mark PcodeOp as LOAD/STORE from spacebase ptr. | |
| void | opClearSpacebasePtr (PcodeOp *op) |
| Unmark PcodeOp as using spacebase ptr. | |
| void | opFlipCondition (PcodeOp *op) |
| Flip output condition of given CBRANCH. | |
| PcodeOp * | target (const Address &addr) const |
| Look up a PcodeOp by an instruction Address. | |
| Varnode * | createStackRef (AddrSpace *spc, uintb off, PcodeOp *op, Varnode *stackptr, bool insertafter) |
| Create an INT_ADD PcodeOp calculating an offset to the spacebase register. More... | |
| Varnode * | opStackLoad (AddrSpace *spc, uintb off, uint4 sz, PcodeOp *op, Varnode *stackptr, bool insertafter) |
| Create a LOAD expression at an offset relative to a spacebase register for a given address space. More... | |
| PcodeOp * | opStackStore (AddrSpace *spc, uintb off, PcodeOp *op, bool insertafter) |
| Create a STORE expression at an offset relative to a spacebase register for a given address space. More... | |
| void | opUndoPtradd (PcodeOp *op, bool finalize) |
| Convert a CPUI_PTRADD back into a CPUI_INT_ADD. More... | |
| list< PcodeOp * >::const_iterator | beginOp (OpCode opc) const |
| Start of PcodeOp objects with the given op-code. | |
| list< PcodeOp * >::const_iterator | endOp (OpCode opc) const |
| End of PcodeOp objects with the given op-code. | |
| list< PcodeOp * >::const_iterator | beginOpAlive (void) const |
| Start of PcodeOp objects in the alive list. | |
| list< PcodeOp * >::const_iterator | endOpAlive (void) const |
| End of PcodeOp objects in the alive list. | |
| list< PcodeOp * >::const_iterator | beginOpDead (void) const |
| Start of PcodeOp objects in the dead list. | |
| list< PcodeOp * >::const_iterator | endOpDead (void) const |
| End of PcodeOp objects in the dead list. | |
| PcodeOpTree::const_iterator | beginOpAll (void) const |
| Start of all (alive) PcodeOp objects sorted by sequence number. | |
| PcodeOpTree::const_iterator | endOpAll (void) const |
| End of all (alive) PcodeOp objects sorted by sequence number. | |
| PcodeOpTree::const_iterator | beginOp (const Address &addr) const |
| Start of all (alive) PcodeOp objects attached to a specific Address. | |
| PcodeOpTree::const_iterator | endOp (const Address &addr) const |
| End of all (alive) PcodeOp objects attached to a specific Address. | |
| JumpTable * | linkJumpTable (PcodeOp *op) |
| Link jump-table with a given BRANCHIND. More... | |
| JumpTable * | findJumpTable (const PcodeOp *op) const |
| Find a jump-table associated with a given BRANCHIND. More... | |
| JumpTable * | installJumpTable (const Address &addr) |
| Install a new jump-table for the given Address. More... | |
| JumpTable * | recoverJumpTable (PcodeOp *op, FlowInfo *flow, int4 &failuremode) |
| Recover destinations for a BRANCHIND by analyzing nearby data and control-flow. More... | |
| int4 | numJumpTables (void) const |
| Get the number of jump-tables for this function. | |
| JumpTable * | getJumpTable (int4 i) |
| Get the i-th jump-table. | |
| void | removeJumpTable (JumpTable *jt) |
| Remove/delete the given jump-table. More... | |
| BlockGraph & | getStructure (void) |
| Get the current control-flow structuring hierarchy. | |
| const BlockGraph & | getStructure (void) const |
| Get the current control-flow structuring hierarchy. | |
| const BlockGraph & | getBasicBlocks (void) const |
| Get the basic blocks container. | |
| void | setBasicBlockRange (BlockBasic *bb, const Address &beg, const Address &end) |
| Set the initial ownership range for the given basic block. More... | |
| void | removeDoNothingBlock (BlockBasic *bb) |
| Remove a basic block from control-flow that performs no operations. More... | |
| bool | removeUnreachableBlocks (bool issuewarning, bool checkexistence) |
| Remove any unreachable basic blocks. More... | |
| void | pushBranch (BlockBasic *bb, int4 slot, BlockBasic *bbnew) |
| Move a control-flow edge from one block to another. More... | |
| void | removeBranch (BlockBasic *bb, int4 num) |
| Remove the indicated branch from a basic block. More... | |
| BlockBasic * | nodeJoinCreateBlock (BlockBasic *block1, BlockBasic *block2, BlockBasic *exita, BlockBasic *exitb, bool fora_block1ishigh, bool forb_block1ishigh, const Address &addr) |
| Create a new basic block for holding a merged CBRANCH. More... | |
| void | nodeSplit (BlockBasic *b, int4 inedge) |
| Split control-flow into a basic block, duplicating its p-code into a new block. More... | |
| bool | forceGoto (const Address &pcop, const Address &pcdest) |
| Force a specific control-flow edge to be marked as unstructured. More... | |
| void | removeFromFlowSplit (BlockBasic *bl, bool swap) |
| Remove a basic block splitting its control-flow into two distinct paths. More... | |
| void | switchEdge (FlowBlock *inblock, BlockBasic *outbefore, FlowBlock *outafter) |
| Switch an outgoing edge from the given source block to flow into another block. More... | |
| void | spliceBlockBasic (BlockBasic *bl) |
| Merge the given basic block with the block it flows into. More... | |
| void | installSwitchDefaults (void) |
| Make sure default switch cases are properly labeled. | |
| bool | replaceLessequal (PcodeOp *op) |
| Replace INT_LESSEQUAL and INT_SLESSEQUAL expressions. More... | |
| bool | distributeIntMultAdd (PcodeOp *op) |
| Distribute constant coefficient to additive input. More... | |
| bool | collapseIntMultMult (Varnode *vn) |
| Collapse constant coefficients for two chained CPUI_INT_MULT. More... | |
Static Public Member Functions | |
| static bool | compareCallspecs (const FuncCallSpecs *a, const FuncCallSpecs *b) |
| Compare call specification objects by call site address. More... | |
Private Types | |
| enum | { highlevel_on = 1, blocks_generated = 2, blocks_unreachable = 4, processing_started = 8, processing_complete = 0x10, typerecovery_on = 0x20, no_code = 0x40, jumptablerecovery_on = 0x80, jumptablerecovery_dont = 0x100, restart_pending = 0x200, unimplemented_present = 0x400, baddata_present = 0x800, double_precis_on = 0x1000 } |
Private Member Functions | |
| void | setVarnodeProperties (Varnode *vn) const |
| Look-up boolean properties and data-type information. More... | |
| HighVariable * | assignHigh (Varnode *vn) |
| Assign a new HighVariable to a Varnode. More... | |
| Symbol * | handleSymbolConflict (SymbolEntry *entry, Varnode *vn) |
| Handle two variables with matching storage. More... | |
| bool | syncVarnodesWithSymbol (VarnodeLocSet::const_iterator &iter, uint4 flags, Datatype *ct) |
| Update properties (and the data-type) for a set of Varnodes associated with one Symbol. More... | |
| bool | descend2Undef (Varnode *vn) |
| Transform all reads of the given Varnode to a special undefined constant. More... | |
| void | splitUses (Varnode *vn) |
| Make all reads of the given Varnode unique. More... | |
| Varnode * | cloneVarnode (const Varnode *vn) |
| Clone a Varnode (between copies of the function) More... | |
| void | destroyVarnode (Varnode *vn) |
| Delete the given Varnode from this function. More... | |
| void | coverVarnodes (SymbolEntry *entry, vector< Varnode * > &list) |
| Make sure every Varnode in the given list has a Symbol it will link to. More... | |
| void | opZeroMulti (PcodeOp *op) |
| Transform trivial CPUI_MULTIEQUAL to CPUI_COPY. More... | |
| void | blockRemoveInternal (BlockBasic *bb, bool unreachable) |
| Remove an active basic block from the function. More... | |
| void | branchRemoveInternal (BlockBasic *bb, int4 num) |
| Remove an outgoing branch of the given basic block. More... | |
| void | pushMultiequals (BlockBasic *bb) |
| Push MULTIEQUAL Varnodes of the given block into the output block. More... | |
| void | clearBlocks (void) |
| Clear all basic blocks. | |
| void | structureReset (void) |
| Calculate initial basic block structures (after a control-flow change) More... | |
| int4 | stageJumpTable (JumpTable *jt, PcodeOp *op, FlowInfo *flow) |
| Recover a jump-table for a given BRANCHIND using existing flow information. More... | |
| void | switchOverJumpTables (const FlowInfo &flow) |
| Convert jump-table addresses to basic block indices. More... | |
| void | clearJumpTables (void) |
| Clear any jump-table information. More... | |
| void | sortCallSpecs (void) |
| Sort calls using a dominance based order. More... | |
| void | deleteCallSpecs (PcodeOp *op) |
| Remove the specification for a particular call. More... | |
| void | clearCallSpecs (void) |
| Remove all call specifications. | |
| BlockBasic * | nodeSplitBlockEdge (BlockBasic *b, int4 inedge) |
| Split given basic block b along an in edge. More... | |
| PcodeOp * | nodeSplitCloneOp (PcodeOp *op) |
| Duplicate the given PcodeOp as part of splitting a block. More... | |
| void | nodeSplitCloneVarnode (PcodeOp *op, PcodeOp *newop) |
| Duplicate output Varnode of the given p-code op, as part of splitting a block. More... | |
| void | nodeSplitRawDuplicate (BlockBasic *b, BlockBasic *bprime) |
| Clone all p-code ops from a block into its copy. More... | |
| void | nodeSplitInputPatch (BlockBasic *b, BlockBasic *bprime, int4 inedge) |
| Patch Varnode inputs to p-code ops in split basic block. More... | |
Static Private Member Functions | |
| static bool | descendantsOutside (Varnode *vn) |
| Check if given Varnode has any descendants in a dead block. More... | |
| static void | saveVarnodeXml (ostream &s, VarnodeLocSet::const_iterator iter, VarnodeLocSet::const_iterator enditer) |
| Save XML descriptions for a set of Varnodes to stream. More... | |
| static bool | checkIndirectUse (Varnode *vn) |
| Check if the given Varnode only flows into call-based INDIRECT ops. More... | |
| static PcodeOp * | findPrimaryBranch (PcodeOpTree::const_iterator iter, PcodeOpTree::const_iterator enditer, bool findbranch, bool findcall, bool findreturn) |
| Find the primary branch operation for an instruction. More... | |
Private Attributes | |
| uint4 | flags |
| Boolean properties associated with this function. | |
| uint4 | clean_up_index |
| Creation index of first Varnode created after start of cleanup. | |
| uint4 | high_level_index |
| Creation index of first Varnode created after HighVariables are created. | |
| uint4 | cast_phase_index |
| Creation index of first Varnode created after ActionSetCasts. | |
| uint4 | minLanedSize |
| Minimum Varnode size to check as LanedRegister. | |
| int4 | size |
| Number of bytes of binary data in function body. | |
| Architecture * | glb |
| Global configuration data. | |
| FunctionSymbol * | functionSymbol |
| The symbol representing this function. | |
| string | name |
| Name of function. | |
| Address | baseaddr |
| Starting code address of binary data. | |
| FuncProto | funcp |
| Prototype of this function. | |
| ScopeLocal * | localmap |
| Local variables (symbols in the function scope) | |
| vector< FuncCallSpecs * > | qlst |
| List of calls this function makes. | |
| vector< JumpTable * > | jumpvec |
| List of jump-tables for this function. | |
| VarnodeBank | vbank |
| Container of Varnode objects for this function. | |
| PcodeOpBank | obank |
| Container of PcodeOp objects for this function. | |
| BlockGraph | bblocks |
| Unstructured basic blocks. | |
| BlockGraph | sblocks |
| Structured block hierarchy (on top of basic blocks) | |
| Heritage | heritage |
| Manager for maintaining SSA form. | |
| Merge | covermerge |
| Variable range intersection algorithms. | |
| ParamActive * | activeoutput |
| Data for assessing which parameters are passed to this function. | |
| Override | localoverride |
| Overrides of data-flow, prototypes, etc. that are local to this function. | |
| map< VarnodeData, const LanedRegister * > | lanedMap |
| Current storage locations which may be laned registers. | |
Container for data structures associated with a single function.
This class holds the primary data structures for decompiling a function. In particular it holds control-flow, data-flow, and prototype information, plus class instances to help with constructing SSA form, structure control-flow, recover jump-tables, recover parameters, and merge Varnodes. In most cases it acts as the main API for querying and accessing these structures.
Some important groups of public methods include:
|
private |
| Enumerator | |
|---|---|
| highlevel_on |
Set if Varnodes have HighVariables assigned. |
| blocks_generated |
Set if Basic blocks have been generated. |
| blocks_unreachable |
Set if at least one basic block is currently unreachable. |
| processing_started |
Set if processing has started. |
| processing_complete |
Set if processing completed. |
| typerecovery_on |
Set if data-type recovery is started. |
| no_code |
Set if there is no code available for this function. |
| jumptablerecovery_on |
Set if this Funcdata object is dedicated to jump-table recovery. |
| jumptablerecovery_dont |
Don't try to recover jump-tables, always truncate. |
| restart_pending |
Analysis must be restarted (because of new override info) |
| unimplemented_present |
Set if function contains unimplemented instructions. |
| baddata_present |
Set if function flowed into bad data. |
| double_precis_on |
Set if we are performing double precision recovery. |
| Funcdata::Funcdata | ( | const string & | nm, |
| Scope * | scope, | ||
| const Address & | addr, | ||
| FunctionSymbol * | sym, | ||
| int4 | sz = 0 |
||
| ) |
Constructor.
| nm | is the (base) name of the function |
| scope | is Symbol scope associated with the function |
| addr | is the entry address for the function |
| sz | is the number of bytes (of code) in the function body |
References activeoutput, Database::attachScope(), baseaddr, cast_phase_index, clean_up_index, flags, funcp, functionSymbol, Scope::getArch(), Symbol::getId(), Architecture::getMinimumLanedRegisterSize(), Address::getOffset(), AddrSpaceManager::getStackSpace(), glb, high_level_index, localmap, minLanedSize, name, ScopeLocal::resetLocalWindow(), FuncProto::setScope(), size, and Architecture::symboltab.
| void Funcdata::adjustInputVarnodes | ( | const Address & | addr, |
| int4 | size | ||
| ) |
Adjust input Varnodes contained in the given range.
After this call, a single input Varnode will exist that fills the given range. Any previous input Varnodes contained in this range are redefined using a SUBPIECE op off of the new single input. If an overlapping Varnode isn't fully contained an exception is thrown.
| addr | is the starting address of the range |
| size | is the number of bytes in the range |
References bblocks, VarnodeBank::beginDef(), CPUI_SUBPIECE, deleteVarnode(), VarnodeBank::endDef(), Varnode::getAddr(), getAddress(), BlockGraph::getBlock(), Address::getOffset(), Varnode::getOffset(), Varnode::getSize(), Varnode::input, Varnode::isInput(), Address::justifiedContain(), newConstant(), newOp(), newVarnode(), newVarnodeOut(), opInsertBegin(), opSetInput(), opSetOpcode(), setInputVarnode(), Varnode::setWriteMask(), totalReplace(), and vbank.
Referenced by ActionUnjustifiedParams::apply(), and numVarnodes().
| bool Funcdata::ancestorOpUse | ( | int4 | maxlevel, |
| const Varnode * | invn, | ||
| const PcodeOp * | op, | ||
| ParamTrial & | trial | ||
| ) | const |
Test if the given trial Varnode is likely only used for parameter passing.
Flow is followed from the Varnode itself and from ancestors the Varnode was copied from to see if it hits anything other than the given CALL or RETURN operation.
| maxlevel | is the maximum number of times to recurse through ancestor copies |
| invn | is the given trial Varnode to test |
| op | is the given CALL or RETURN |
| trial | is the associated parameter trial object |
References PcodeOp::clearMark(), PcodeOp::code(), CPUI_CALL, CPUI_CALLIND, CPUI_COPY, CPUI_INDIRECT, CPUI_INT_REM, CPUI_INT_SREM, CPUI_MULTIEQUAL, CPUI_PIECE, CPUI_SUBPIECE, Varnode::getDef(), PcodeOp::getIn(), Varnode::getOffset(), Varnode::getSpace(), AddrSpace::getType(), IPTR_INTERNAL, PcodeOp::isIncidentalCopy(), Varnode::isIncidentalCopy(), PcodeOp::isIndirectCreation(), Varnode::isInput(), PcodeOp::isMark(), Varnode::isTypeLock(), Varnode::isWritten(), PcodeOp::numInput(), onlyOpUse(), PcodeOp::setMark(), and ParamTrial::setRemFormed().
Referenced by ActionReturnRecovery::apply(), FuncCallSpecs::checkInputTrialUse(), and clearLanedAccessMap().
|
private |
Assign a new HighVariable to a Varnode.
If HighVariables are enabled, make sure the given Varnode has one assigned. Allocate a dedicated HighVariable, that contains only the one Varnode if necessary.
| vn | is the given Varnode |
References Varnode::calcCover(), flags, Varnode::hasCover(), highlevel_on, and Varnode::isAnnotation().
Referenced by newCodeRef(), newConstant(), newUnique(), newUniqueOut(), newVarnode(), newVarnodeCallSpecs(), newVarnodeIop(), newVarnodeOut(), newVarnodeSpace(), and setHighLevel().
| bool Funcdata::attemptDynamicMapping | ( | SymbolEntry * | entry, |
| DynamicHash & | dhash | ||
| ) |
Map properties of a dynamic symbol to a Varnode.
Given a dynamic mapping, try to find the mapped Varnode, then adjust (type and flags) to reflect this mapping.
| entry | is the (dynamic) Symbol entry |
| dhash | is the dynamic mapping information |
References DynamicHash::clear(), DynamicHash::findVarnode(), Symbol::getCategory(), SymbolEntry::getFirstUseAddress(), SymbolEntry::getHash(), Symbol::getScope(), SymbolEntry::getSize(), Varnode::getSize(), SymbolEntry::getSymbol(), localmap, Varnode::mapentry, Varnode::setSymbolEntry(), and Varnode::setSymbolProperties().
Referenced by ActionDynamicMapping::apply(), and clearDeadOps().
| bool Funcdata::attemptDynamicMappingLate | ( | SymbolEntry * | entry, |
| DynamicHash & | dhash | ||
| ) |
Map the name of a dynamic symbol to a Varnode.
Given a dynamic mapping, try to find the mapped Varnode, then attach the Symbol to the Varnode. The name of the Symbol is used, but the data-type and possibly other properties are not put on the Varnode.
| entry | is the (dynamic) Symbol entry |
| dhash | is the dynamic mapping information |
References DynamicHash::clear(), PcodeOp::code(), CPUI_CAST, DynamicHash::findVarnode(), Varnode::getDef(), SymbolEntry::getFirstUseAddress(), SymbolEntry::getHash(), PcodeOp::getIn(), Symbol::getName(), PcodeOp::getOut(), SymbolEntry::getSize(), Varnode::getSize(), SymbolEntry::getSymbol(), Varnode::getSymbolEntry(), Varnode::getType(), Symbol::getType(), Varnode::isExplicit(), Varnode::isImplied(), Symbol::isNameUndefined(), Symbol::isTypeLocked(), Varnode::isWritten(), localmap, Varnode::loneDescend(), ScopeInternal::retypeSymbol(), Varnode::setSymbolEntry(), and warningHeader().
Referenced by ActionDynamicSymbols::apply(), and clearDeadOps().
|
private |
Remove an active basic block from the function.
PcodeOps in the block are deleted. Data-flow and control-flow are otherwise patched up. Most of the work is patching up MULTIEQUALs and other remaining references to Varnodes flowing through the block to be removed.
If descendant Varnodes are stranded by removing the block, either an exception is thrown, or optionally, the descendant Varnodes can be replaced with constants and a warning is printed.
| bb | is the given basic block |
| unreachable | is true if the caller wants a warning for stranded Varnodes |
References bblocks, BlockBasic::beginOp(), PcodeOp::code(), CPUI_BRANCHIND, CPUI_MULTIEQUAL, deleteCallSpecs(), descend2Undef(), descendantsOutside(), BlockBasic::endOp(), findJumpTable(), Varnode::getDef(), PcodeOp::getIn(), FlowBlock::getInIndex(), PcodeOp::getOut(), FlowBlock::getOut(), PcodeOp::getParent(), PcodeOp::isAssignment(), PcodeOp::isCall(), FlowBlock::isDead(), Varnode::isWritten(), BlockBasic::lastOp(), PcodeOp::numInput(), opDestroy(), opInsertInput(), opRemoveInput(), opZeroMulti(), pushMultiequals(), BlockGraph::removeBlock(), BlockGraph::removeFromFlow(), removeJumpTable(), FlowBlock::sizeIn(), FlowBlock::sizeOut(), and warningHeader().
Referenced by removeDoNothingBlock(), and removeUnreachableBlocks().
|
private |
Remove an outgoing branch of the given basic block.
MULTIEQUAL p-code ops (in other blocks) that take inputs from the outgoing branch are patched appropriately.
| bb | is the given basic block |
| num | is the index of the outgoing edge to remove |
References bblocks, BlockBasic::beginOp(), PcodeOp::code(), CPUI_MULTIEQUAL, BlockBasic::endOp(), FlowBlock::getInIndex(), FlowBlock::getOut(), BlockBasic::lastOp(), opDestroy(), opRemoveInput(), opZeroMulti(), BlockGraph::removeEdge(), and FlowBlock::sizeOut().
Referenced by removeBranch(), and removeUnreachableBlocks().
| void Funcdata::buildDynamicSymbol | ( | Varnode * | vn | ) |
Build a dynamic Symbol associated with the given Varnode.
If a Symbol is already attached, no change is made. Otherwise a special dynamic Symbol is created that is associated with the Varnode via a hash of its local data-flow (rather than its storage address).
| vn | is the given Varnode |
References Scope::addDynamicSymbol(), DynamicHash::getAddress(), Symbol::getFirstWholeMap(), DynamicHash::getHash(), Varnode::getHigh(), HighVariable::getSymbol(), HighVariable::getType(), isHighOn(), Varnode::isNameLock(), Varnode::isTypeLock(), localmap, Varnode::setSymbolEntry(), and DynamicHash::uniqueHash().
Referenced by clearDeadOps(), and handleSymbolConflict().
| void Funcdata::calcNZMask | ( | void | ) |
Calculate non-zero masks for all Varnodes.
All Varnodes are initialized assuming that all its bits are possibly non-zero. This method looks for situations where a p-code produces a value that is known to have some bits that are guaranteed to be zero. It updates the state of the output Varnode then tries to push the information forward through the data-flow until additional changes are apparent.
References Varnode::beginDescend(), beginOpAlive(), calc_mask(), PcodeOp::clearMark(), PcodeOp::code(), CPUI_MULTIEQUAL, Varnode::endDescend(), endOpAlive(), Varnode::getDef(), PcodeOp::getIn(), PcodeOp::getNZMaskLocal(), Varnode::getOffset(), PcodeOp::getOut(), PcodeOp::getParent(), Varnode::getSize(), Varnode::isConstant(), FlowBlock::isLoopIn(), PcodeOp::isMark(), Varnode::isSpacebase(), Varnode::isWritten(), PcodeOp::numInput(), Varnode::nzm, and PcodeOp::setMark().
Referenced by ActionNonzeroMask::apply(), and getActiveOutput().
| bool Funcdata::checkCallDoubleUse | ( | const PcodeOp * | opmatch, |
| const PcodeOp * | op, | ||
| const Varnode * | vn, | ||
| const ParamTrial & | trial | ||
| ) | const |
Test for legitimate double use of a parameter trial.
The given trial is a putative input to first CALL, but can also trace its data-flow into a second CALL. Return false if this leads us to conclude that the trial is not a likely parameter.
| opmatch | is the first CALL linked to the trial |
| op | is the second CALL |
| vn | is the Varnode parameter for the second CALL |
| trial | is the given parameter trial |
References PcodeOp::code(), CPUI_CALL, FuncCallSpecs::getActiveInput(), ParamTrial::getAddress(), getCallSpecs(), FuncCallSpecs::getEntryAddress(), PcodeOp::getIn(), SeqNum::getOrder(), PcodeOp::getParent(), PcodeOp::getSeqNum(), PcodeOp::getSlot(), ParamActive::getTrialForInputVarnode(), and FuncCallSpecs::isInputActive().
Referenced by clearLanedAccessMap(), and onlyOpUse().
| void Funcdata::checkForLanedRegister | ( | int4 | size, |
| const Address & | addr | ||
| ) |
Check for a potential laned register.
Check if the given storage range is a potential laned register. If so, record the storage with the matching laned register record.
| s | is the size of the storage range in bytes |
| addr | is the starting address of the storage range |
References Architecture::getLanedRegister(), Address::getOffset(), Address::getSpace(), glb, lanedMap, VarnodeData::offset, VarnodeData::size, size, and VarnodeData::space.
Referenced by endDef(), newUnique(), newUniqueOut(), newVarnode(), and newVarnodeOut().
|
staticprivate |
Check if the given Varnode only flows into call-based INDIRECT ops.
Flow is only followed through MULTIEQUAL ops.
| vn | is the given Varnode |
References Varnode::beginDescend(), PcodeOp::code(), CPUI_INDIRECT, CPUI_MULTIEQUAL, Varnode::endDescend(), PcodeOp::getOut(), PcodeOp::isIndirectStore(), Varnode::isMark(), and Varnode::setMark().
Referenced by markIndirectOnly().
| void Funcdata::clearDeadVarnodes | ( | void | ) |
Delete any dead Varnodes.
Free any Varnodes not attached to anything. This is only performed at fixed times so that editing operations can detach (and then reattach) Varnodes without losing them.
References VarnodeBank::beginLoc(), Varnode::clearCover(), VarnodeBank::destroy(), VarnodeBank::endLoc(), Varnode::hasNoDescend(), Varnode::isFree(), Varnode::isInput(), Varnode::isLockedInput(), VarnodeBank::makeFree(), and vbank.
Referenced by ActionDeadCode::apply(), ActionInputPrototype::apply(), and getActiveOutput().
|
private |
Clear any jump-table information.
Any override information is preserved.
References JumpTable::clear(), JumpTable::isOverride(), and jumpvec.
Referenced by clear().
| void Funcdata::clearSymbolLinks | ( | HighVariable * | high | ) |
Clear Symbols attached to Varnodes in the given HighVariable.
For each instance Varnode, remove any SymbolEntry reference and associated properties.
| high | is the given HighVariable to clear |
References Varnode::clearFlags(), HighVariable::getInstance(), Varnode::mapentry, Varnode::mapped, Varnode::namelock, HighVariable::numInstances(), and Varnode::typelock.
Referenced by clearDeadOps(), remapDynamicVarnode(), and remapVarnode().
Make a clone of the given PcodeOp, copying control-flow properties as well. The data-type is not cloned.
| op | is the PcodeOp to clone |
| seq | is the (possibly custom) sequence number to associate with the clone |
References cloneVarnode(), PcodeOp::code(), flags, PcodeOp::flags, PcodeOp::getIn(), PcodeOp::getOut(), newOp(), PcodeOp::numInput(), opSetInput(), opSetOpcode(), opSetOutput(), PcodeOp::setFlag(), PcodeOp::startbasic, and PcodeOp::startmark.
Referenced by getMerge(), FlowInfo::inlineClone(), FlowInfo::inlineEZClone(), and truncatedFlow().
Clone a Varnode (between copies of the function)
Internal factory for copying Varnodes from another Funcdata object into this.
| vn | is the Varnode to clone |
References Varnode::addrforce, Varnode::addrtied, Varnode::annotation, VarnodeBank::create(), Varnode::externref, Varnode::getAddr(), Varnode::getFlags(), Varnode::getSize(), Varnode::getType(), Varnode::incidental_copy, Varnode::indirect_creation, Varnode::mapped, Varnode::persist, Varnode::readonly, Varnode::setFlags(), vbank, and Varnode::volatil.
Referenced by cloneOp().
| bool Funcdata::collapseIntMultMult | ( | Varnode * | vn | ) |
Collapse constant coefficients for two chained CPUI_INT_MULT.
If:
The constants are combined and true is returned. Otherwise no change is made and false is returned.
| vn | is the given Varnode |
References calc_mask(), PcodeOp::code(), CPUI_INT_MULT, Varnode::getDef(), PcodeOp::getIn(), Varnode::getOffset(), Varnode::getSize(), Varnode::isConstant(), Varnode::isFree(), Varnode::isWritten(), newConstant(), opSetInput(), and size.
Referenced by AddTreeState::apply(), and setBasicBlockRange().
|
static |
Compare call specification objects by call site address.
| a | is the first call specification to compare |
| b | is the second call specification |
References FlowBlock::getIndex(), FuncCallSpecs::getOp(), SeqNum::getOrder(), PcodeOp::getParent(), and PcodeOp::getSeqNum().
Referenced by setBasicBlockRange(), and sortCallSpecs().
|
private |
Make sure every Varnode in the given list has a Symbol it will link to.
This is used when Varnodes overlap a locked Symbol but extend beyond it. An existing Symbol is passed in with a list of possibly overextending Varnodes. The list is in Address order. We check that each Varnode has a Symbol that overlaps its first byte (to guarantee a link). If one doesn't exist it is created.
| entry | is the existing Symbol entry |
| list | is the list of Varnodes |
References Scope::addSymbol(), Scope::findContainer(), SymbolEntry::getAddr(), Varnode::getAddr(), Varnode::getHigh(), Symbol::getName(), Address::getOffset(), Varnode::getOffset(), Symbol::getScope(), Varnode::getSize(), SymbolEntry::getSymbol(), HighVariable::getType(), and Varnode::getUsePoint().
Referenced by mapGlobals().
| Varnode * Funcdata::createStackRef | ( | AddrSpace * | spc, |
| uintb | off, | ||
| PcodeOp * | op, | ||
| Varnode * | stackptr, | ||
| bool | insertafter | ||
| ) |
Create an INT_ADD PcodeOp calculating an offset to the spacebase register.
The spacebase register is looked up for the given address space, or an optional previously existing register Varnode can be provided. An insertion point op must be provided, and newly generated ops can come either before or after this insertion point.
| spc | is the given address space |
| off | is the offset to calculate relative to the spacebase register |
| op | is the insertion point PcodeOp |
| stackptr | is the spacebase register Varnode (if available) |
| insertafter | is true if new ops are inserted after the insertion point |
References AddrSpace::byteToAddress(), CPUI_INT_ADD, CPUI_SEGMENTOP, PcodeOp::getAddr(), AddrSpace::getAddrSize(), SegmentOp::getBaseSize(), AddrSpace::getContain(), AddrSpace::getIndex(), UserOpManage::getSegmentOp(), Varnode::getSize(), AddrSpace::getWordSize(), glb, newConstant(), newOp(), newSpacebasePtr(), newUniqueOut(), newVarnodeSpace(), opInsertAfter(), opInsertBefore(), opSetInput(), opSetOpcode(), and Architecture::userops.
Referenced by opStackLoad(), opStackStore(), and target().
|
inline |
Check if dead code removal is allowed for a specific address space.
| spc | is the specific address space |
References Heritage::deadRemovalAllowed().
Referenced by ActionDeadCode::apply().
|
inline |
Check if dead Varnodes have been removed for a specific address space.
| spc | is the specific address space |
References Heritage::deadRemovalAllowedSeen().
Referenced by RuleEarlyRemoval::applyOp().
|
private |
Remove the specification for a particular call.
This is used internally if a CALL is removed (because it is unreachable)
| op | is the particular specification to remove |
References FuncCallSpecs::getOp(), and qlst.
Referenced by blockRemoveInternal().
|
private |
Transform all reads of the given Varnode to a special undefined constant.
All p-code ops that read the Varnode are transformed so that they read a special constant instead (associate with unreachable block removal).
| vn | is the given Varnode |
References Varnode::beginDescend(), PcodeOp::code(), CPUI_COPY, CPUI_INDIRECT, CPUI_MULTIEQUAL, Varnode::endDescend(), PcodeOp::getAddr(), FlowBlock::getIn(), PcodeOp::getParent(), Varnode::getSize(), PcodeOp::getSlot(), BlockBasic::getStart(), FlowBlock::isDead(), newConstant(), newOp(), newUniqueOut(), opInsertBefore(), opInsertEnd(), opSetInput(), opSetOpcode(), size, and FlowBlock::sizeIn().
Referenced by blockRemoveInternal().
|
staticprivate |
Check if given Varnode has any descendants in a dead block.
Assuming a basic block is marked dead, return true if any PcodeOp reading the Varnode is in the dead block.
| vn | is the given Varnode |
References Varnode::beginDescend(), and Varnode::endDescend().
Referenced by blockRemoveInternal().
|
private |
Delete the given Varnode from this function.
References to the Varnode are replaced with NULL pointers and the object is freed, with no possibility of resuse.
| vn | is the Varnode to delete |
References Varnode::beginDescend(), PcodeOp::clearInput(), Varnode::def, VarnodeBank::destroy(), Varnode::destroyDescend(), Varnode::endDescend(), PcodeOp::getSlot(), PcodeOp::setOutput(), and vbank.
Referenced by opDestroy(), and opDestroyRaw().
| bool Funcdata::distributeIntMultAdd | ( | PcodeOp * | op | ) |
Distribute constant coefficient to additive input.
If a term has a multiplicative coefficient, but the underlying term is still additive, in some situations we may need to distribute the coefficient before simplifying further. The given PcodeOp is a INT_MULT where the second input is a constant. We also know the first input is formed with INT_ADD. Distribute the coefficient to the INT_ADD inputs.
| op | is the given PcodeOp |
References calc_mask(), CPUI_INT_ADD, CPUI_INT_MULT, PcodeOp::getAddr(), Varnode::getDef(), PcodeOp::getIn(), Varnode::getOffset(), PcodeOp::getOut(), Varnode::getSize(), Varnode::isConstant(), Varnode::isFree(), newConstant(), newOp(), newUniqueOut(), opInsertBefore(), opSetInput(), opSetOpcode(), and size.
Referenced by AddTreeState::apply(), RuleCollectTerms::applyOp(), and setBasicBlockRange().
| void Funcdata::doLiveInject | ( | InjectPayload * | payload, |
| const Address & | addr, | ||
| BlockBasic * | bl, | ||
| list< PcodeOp * >::iterator | iter | ||
| ) |
Inject p-code from a payload into this live function.
Raw PcodeOps are generated from the payload within a given basic block at a specific position in this function.
| payload | is the injection payload |
| addr | is the address at the point of injection |
| bl | is the given basic block holding the new ops |
| iter | indicates the point of insertion |
References PcodeOpBank::beginDead(), PcodeOpBank::endDead(), PcodeInjectLibrary::getCachedContext(), glb, InjectPayload::inject(), PcodeOp::isCallOrBranch(), obank, opInsert(), Architecture::pcodeinjectlib, and PcodeEmitFd::setFuncdata().
Referenced by ActionConstbase::apply(), getCleanUpIndex(), and FuncCallSpecs::insertPcode().
| int4 Funcdata::fillinExtrapop | ( | void | ) |
Recover and return the extrapop for this function.
If extrapop is unknown, recover it from what we know about this function and set the value permanently for this Funcdata object. If there is no function body it may be impossible to know the value, in which case this returns the reserved value indicating extrapop is unknown.
References beginOp(), CPUI_RETURN, endOp(), ProtoModel::extrapop_unknown, funcp, PcodeOp::getAddr(), FuncProto::getExtraPop(), glb, hasNoCode(), Architecture::loader, LoadImage::loadFill(), and FuncProto::setExtraPop().
Referenced by getCallSpecs().
| bool Funcdata::fillinReadOnly | ( | Varnode * | vn | ) |
Replace the given Varnode with its (constant) value in the load image.
Treat the given Varnode as read-only, look up its value in LoadImage and replace read references with the value as a constant Varnode.
| vn | is the given Varnode |
References Varnode::beginDescend(), Varnode::clearFlags(), PcodeOp::code(), CPUI_COPY, CPUI_INDIRECT, Varnode::endDescend(), PcodeOp::getAddr(), Varnode::getAddr(), Varnode::getDef(), AddrSpace::getName(), PcodeOp::getOut(), Varnode::getSize(), PcodeOp::getSlot(), Varnode::getSpace(), Varnode::getType(), glb, Varnode::hasNoDescend(), Varnode::isAddrForce(), AddrSpace::isBigEndian(), PcodeOp::isMarker(), Varnode::isTypeLock(), PcodeOp::isWarning(), Varnode::isWritten(), Architecture::loader, LoadImage::loadFill(), newConstant(), opRemoveInput(), opSetInput(), opSetOpcode(), Address::printRaw(), Varnode::readonly, PcodeOp::setAdditionalFlag(), Varnode::updateType(), PcodeOp::warning, and warning().
Referenced by ActionVarnodeProps::apply(), and clearLanedAccessMap().
Find the first input Varnode covered by the given range.
| s | is the size of the range in bytes |
| loc | is the starting address of the range |
References VarnodeBank::findCoveredInput().
Referenced by ActionLikelyTrash::apply().
Find the input Varnode that contains the given range.
| s | is the size of the range in bytes |
| loc | is the starting address of the range |
References VarnodeBank::findCoveringInput().
Find range covering given Varnode and any intersecting Varnodes.
Find the minimal Address range covering the given Varnode that doesn't split other Varnodes
| vn | is the given Varnode |
| sz | is used to pass back the size of the resulting range |
References beginLoc(), endLoc(), Varnode::getAddr(), Address::getOffset(), Varnode::getSize(), and Varnode::lociter.
Referenced by deleteVarnode(), FuncProto::updateInputNoTypes(), and FuncProto::updateInputTypes().
| HighVariable * Funcdata::findHigh | ( | const string & | name | ) | const |
Find a high-level variable by name.
Look up the Symbol visible in this function's Scope and return the HighVariable associated with it. If the Symbol doesn't exist or there is no Varnode holding at least part of the value of the Symbol, NULL is returned.
| name | is the name to search for |
References findLinkedVarnode(), Symbol::getFirstWholeMap(), Varnode::getHigh(), localmap, and Scope::queryByName().
Referenced by clearLanedAccessMap().
Find a jump-table associated with a given BRANCHIND.
Look up the jump-table object with the matching PcodeOp address
| op | is the given BRANCHIND PcodeOp |
References PcodeOp::getAddr(), JumpTable::getOpAddress(), and jumpvec.
Referenced by ActionDeadCode::apply(), RuleSwitchSingle::applyOp(), blockRemoveInternal(), FlowInfo::collectEdges(), endOp(), and FlowBlock::getJumptable().
| Varnode * Funcdata::findLinkedVarnode | ( | SymbolEntry * | entry | ) | const |
Find a Varnode matching the given Symbol mapping.
Return the (first) Varnode that matches the given SymbolEntry
| entry | is the given SymbolEntry |
References VarnodeBank::beginLoc(), VarnodeBank::endLoc(), DynamicHash::findVarnode(), SymbolEntry::getAddr(), SymbolEntry::getFirstUseAddress(), SymbolEntry::getHash(), SymbolEntry::getSize(), Varnode::getUsePoint(), SymbolEntry::inUse(), Varnode::isAddrTied(), Varnode::isAnnotation(), SymbolEntry::isDynamic(), Address::isInvalid(), and vbank.
Referenced by clearDeadOps(), and findHigh().
| void Funcdata::findLinkedVarnodes | ( | SymbolEntry * | entry, |
| vector< Varnode * > & | res | ||
| ) | const |
Find Varnodes that map to the given SymbolEntry.
Look for Varnodes that are (should be) mapped to the given SymbolEntry and add them to the end of the result list.
| entry | is the given SymbolEntry to match |
| res | is the container holding the result list of matching Varnodes |
References beginLoc(), endLoc(), DynamicHash::findVarnode(), SymbolEntry::getAddr(), SymbolEntry::getFirstUseAddress(), SymbolEntry::getHash(), SymbolEntry::getSize(), Varnode::getUsePoint(), SymbolEntry::inUse(), and SymbolEntry::isDynamic().
Referenced by clearDeadOps().
|
staticprivate |
Find the primary branch operation for an instruction.
For machine instructions that branch, this finds the primary PcodeOp that performs the branch. The instruction is provided as a list of p-code ops, and the caller can specify whether they expect to see a branch, call, or return operation.
| iter | is the start of the operations for the instruction |
| enditer | is the end of the operations for the instruction |
| findbranch | is true if the caller expects to see a BRANCH, CBRANCH, or BRANCHIND |
| findcall | is true if the caller expects to see CALL or CALLIND |
| findreturn | is true if the caller expects to see RETURN |
References PcodeOp::code(), CPUI_BRANCH, CPUI_BRANCHIND, CPUI_CALL, CPUI_CALLIND, CPUI_CBRANCH, CPUI_RETURN, PcodeOp::getIn(), and Varnode::isConstant().
Referenced by overrideFlow().
Given an address space, like stack, that is known to have a base register pointing to it, try to locate the unique Varnode that holds the input value of this register.
| id | is the stack like address space |
References VarnodeBank::findInput(), AddrSpace::getSpacebase(), and vbank.
Referenced by ActionInferTypes::apply(), AliasChecker::gatherInternal(), and hasBadData().
Find the input Varnode with the given size and storage address.
| s | is the size in bytes |
| loc | is the storage address |
References VarnodeBank::findInput().
Referenced by ActionParamDouble::apply(), and ActionRestrictLocal::apply().
|
inline |
Find a defined Varnode via its storage address and its definition address.
| s | is the size in bytes |
| loc | is the storage address |
| pc | is the address where the Varnode is defined |
| uniq | is an (optional) sequence number to match |
References VarnodeBank::find().
Generate raw p-code for the function.
Follow flow from the entry point generating PcodeOps for each instruction encountered. The caller can provide a bounding range that constrains where control can flow to.
| baddr | is the beginning of the constraining range |
| eaddr | is the end of the constraining range |
References baddata_present, bblocks, blocks_generated, PcodeOpBank::empty(), flags, Architecture::flowoptions, FlowInfo::generateBlocks(), FlowInfo::generateOps(), FlowInfo::getSize(), glb, FlowInfo::hasBadData(), FlowInfo::hasUnimplemented(), Architecture::max_instructions, obank, qlst, FlowInfo::setFlags(), FlowInfo::setMaximumInstructions(), FlowInfo::setRange(), size, switchOverJumpTables(), and unimplemented_present.
Referenced by getCleanUpIndex(), and startProcessing().
Force a specific control-flow edge to be marked as unstructured.
The edge is specified by a source and destination Address (of the branch). The resulting control-flow structure will have a goto statement modeling the edge.
References bblocks, PcodeOp::getAddr(), BlockGraph::getBlock(), FlowBlock::getOut(), BlockGraph::getSize(), FlowBlock::lastOp(), FlowBlock::setGotoBranch(), and FlowBlock::sizeOut().
Referenced by Override::applyForceGoto(), and setBasicBlockRange().
| PcodeOp * Funcdata::getFirstReturnOp | ( | void | ) | const |
Clone a PcodeOp into this function.
Return the first CPUI_RETURN operation that is not dead or an artificial halt
References beginOp(), CPUI_RETURN, endOp(), PcodeOp::getHaltType(), and PcodeOp::isDead().
Referenced by ActionOutputPrototype::apply(), PrintC::emitPrototypeOutput(), and getMerge().
|
private |
Handle two variables with matching storage.
A Varnode overlaps the given SymbolEntry. Make sure the Varnode is part of the variable underlying the Symbol. If not, remap things so that the Varnode maps to a distinct Symbol. In either case, attach the appropriate Symbol to the Varnode
| entry | is the given SymbolEntry |
| vn | is the overlapping Varnode |
References beginLoc(), buildDynamicSymbol(), endLoc(), SymbolEntry::getAddr(), Varnode::getAddr(), Varnode::getHigh(), SymbolEntry::getSize(), Varnode::getSize(), SymbolEntry::getSymbol(), Varnode::getSymbolEntry(), Varnode::isAddrTied(), Varnode::isConstant(), SymbolEntry::isDynamic(), Varnode::isInput(), Varnode::isPersist(), and Varnode::setSymbolEntry().
Referenced by linkSymbol().
|
inline |
Does this function need to restart its analysis.
References restart_pending.
Referenced by ActionRestartGroup::apply().
|
inline |
Does this function have instructions marked as unimplemented.
References unimplemented_present.
| void Funcdata::initActiveOutput | ( | void | ) |
Initialize return prototype recovery analysis
References activeoutput, funcp, FuncProto::getMaxOutputDelay(), and ParamActive::setMaxPass().
Referenced by ActionPrototypeTypes::apply(), and getFuncProto().
In-line the p-code from another function into this function.
Raw PcodeOps for the in-line function are generated and then cloned into this function. Depending on the control-flow complexity of the in-line function, the PcodeOps are injected as if they are all part of the call site address (EZModel), or the PcodeOps preserve their address and extra branch instructions are inserted to integrate control-flow of the in-line into the calling function.
| inlinefd | is the function to in-line |
| flow | is the flow object being injected |
| callop | is the site of the injection |
References baseaddr, bblocks, FlowInfo::checkEZModel(), Architecture::clearAnalysis(), PcodeOp::clearFlag(), CPUI_BRANCH, PcodeOpBank::endDead(), FlowInfo::error_outofbounds, FlowInfo::error_reinterpreted, FlowInfo::error_unimplemented, FlowInfo::flow_forinline, FlowInfo::forwardRecursion(), FlowInfo::generateOps(), PcodeOp::getAddr(), getAddress(), getArch(), Address::getSpace(), PcodeOpBank::getUniqId(), FlowInfo::inlineClone(), FlowInfo::inlineEZClone(), PcodeOp::isBlockStart(), jumpvec, PcodeOpBank::moveSequenceDead(), newCodeRef(), PcodeOp::numInput(), obank, opDestroyRaw(), opRemoveInput(), opSetInput(), opSetOpcode(), qlst, PcodeOp::setFlag(), FlowInfo::setFlags(), FlowInfo::setRange(), PcodeOpBank::setUniqId(), PcodeOp::startbasic, and FlowInfo::testHardInlineRestrictions().
Referenced by getCleanUpIndex(), and FlowInfo::inlineSubFunction().
Install a new jump-table for the given Address.
The given address must have a BRANCHIND op attached to it. This is suitable for installing an override and must be called before flow has been traced.
| addr | is the given Address |
References JumpTable::getOpAddress(), glb, isProcStarted(), and jumpvec.
Referenced by endOp().
|
inline |
Check if a specific Varnode has been linked in fully to the syntax tree (SSA)
| vn | is the specific Varnode |
References Varnode::getAddr(), and Heritage::heritagePass().
Referenced by cseEliminateList().
Link jump-table with a given BRANCHIND.
Look up the jump-table object with the matching PcodeOp address, then attach the given PcodeOp to it.
| op | is the given BRANCHIND PcodeOp |
References PcodeOp::getAddr(), JumpTable::getOpAddress(), jumpvec, and JumpTable::setIndirectOp().
Referenced by endOp(), recoverJumpTable(), and FlowInfo::xrefInlinedBranch().
Find or create Symbol associated with given Varnode.
The Symbol is really attached to the Varnode's HighVariable (which must exist). The only reason a Symbol doesn't get set is if, the HighVariable is global and there is no pre-existing Symbol. (see mapGlobals())
| vn | is the given Varnode |
References Scope::addSymbol(), flags, Varnode::getAddr(), Varnode::getHigh(), HighVariable::getSymbol(), SymbolEntry::getSymbol(), HighVariable::getType(), Varnode::getUsePoint(), handleSymbolConflict(), Varnode::isPersist(), localmap, Scope::queryProperties(), and Varnode::setSymbolEntry().
Referenced by clearDeadOps(), and ActionNameVars::linkSymbols().
Discover and attach Symbol to a constant reference.
A reference to a symbol (i.e. &varname) is typically stored as a PTRSUB operation, where the first input Varnode is a spacebase Varnode indicating whether the symbol is on the stack or at a global RAM location. The second input Varnode is a constant encoding the address of the symbol. This method takes this constant Varnode, recovers the symbol it is referring to, and stores on the HighVariable object attached to the Varnode.
| vn | is the constant Varnode (second input) to a PTRSUB operation |
References SymbolEntry::getAddr(), PcodeOp::getAddr(), TypeSpacebase::getAddress(), Varnode::getHigh(), PcodeOp::getIn(), TypeSpacebase::getMap(), Datatype::getMetatype(), Address::getOffset(), SymbolEntry::getOffset(), Varnode::getOffset(), TypePointer::getPtrTo(), Varnode::getSize(), SymbolEntry::getSymbol(), HighVariable::getType(), Address::isInvalid(), Varnode::loneDescend(), Scope::queryContainer(), Varnode::setSymbolReference(), TYPE_PTR, and TYPE_SPACEBASE.
Referenced by clearDeadOps(), and ActionNameVars::linkSpacebaseSymbol().
| void Funcdata::mapGlobals | ( | void | ) |
Make sure there is a Symbol entry for all global Varnodes.
Search for addrtied Varnodes whose storage falls in the global Scope, then build a new global Symbol if one didn't exist before.
References Varnode::addrtied, Scope::addSymbol(), VarnodeBank::beginLoc(), Scope::buildVariableName(), coverVarnodes(), Scope::discoverScope(), VarnodeBank::endLoc(), flags, SymbolEntry::getAddr(), Varnode::getAddr(), TypeFactory::getBase(), Varnode::getHigh(), Address::getOffset(), Datatype::getSize(), SymbolEntry::getSize(), Varnode::getSize(), Varnode::getSymbolEntry(), HighVariable::getType(), glb, Varnode::isFree(), Varnode::isPersist(), localmap, Varnode::persist, Scope::queryProperties(), TYPE_UNKNOWN, Architecture::types, vbank, and warningHeader().
Referenced by ActionMapGlobals::apply(), and clearLanedAccessMap().
| void Funcdata::markIndirectCreation | ( | PcodeOp * | indop, |
| bool | possibleOutput | ||
| ) |
Convert CPUI_INDIRECT into an indirect creation.
Data-flow through the given CPUI_INDIRECT op is marked so that the output Varnode is considered indirectly created. An indirectly created Varnode effectively has no data-flow before the INDIRECT op that defines it, and the value contained by the Varnode is not explicitly calculable.
| indop | is the given CPUI_INDIRECT op |
| possibleOutput | is true if INDIRECT should be marked as a possible call output |
References PcodeOp::flags, Varnode::flags, PcodeOp::getIn(), PcodeOp::getOut(), PcodeOp::indirect_creation, Varnode::indirect_creation, and Varnode::isConstant().
Referenced by ActionLikelyTrash::apply(), getMerge(), and TransformManager::specialHandling().
| void Funcdata::markIndirectOnly | ( | void | ) |
Mark illegal input Varnodes used only in INDIRECTs.
The illegal inputs are additionally marked as indirectonly and isIndirectOnly() returns true.
References beginDef(), checkIndirectUse(), endDef(), Varnode::indirectonly, Varnode::input, Varnode::isIllegalInput(), and Varnode::setFlags().
Referenced by ActionMarkIndirectOnly::apply(), and clearLanedAccessMap().
Create a code address annotation Varnode.
A reference to a specific Address is encoded in a Varnode. The Varnode is an annotation in the sense that it will hold no value in the data-flow, it will will only hold a reference to an address. This is used specifically by the branch p-code operations to hold destination addresses.
| m | is the Address to encode |
References Varnode::annotation, assignHigh(), VarnodeBank::create(), TypeFactory::getTypeCode(), glb, Varnode::setFlags(), Architecture::types, and vbank.
Referenced by RuleSwitchSingle::applyOp(), FlowInfo::checkContainedCall(), FlowInfo::inlineClone(), inlineFlow(), nodeSplitInputPatch(), numVarnodes(), and replaceVolatile().
| Varnode * Funcdata::newConstant | ( | int4 | s, |
| uintb | constant_val | ||
| ) |
Create a new constant Varnode.
A Varnode is allocated which represents the indicated constant value. Its storage address is in the constant address space.
| s | is the size of the Varnode in bytes |
| constant_val | is the indicated constant value |
References assignHigh(), VarnodeBank::create(), TypeFactory::getBase(), AddrSpaceManager::getConstant(), glb, TYPE_UNKNOWN, Architecture::types, and vbank.
Referenced by adjustInputVarnodes(), ActionStackPtrFlow::adjustLoad(), ActionStackPtrFlow::analyzeExtraPop(), ActionSegmentize::apply(), ActionConstbase::apply(), ActionPrototypeTypes::apply(), ActionExtraPopSetup::apply(), ActionLikelyTrash::apply(), RuleCollectTerms::applyOp(), RuleAndMask::applyOp(), RuleAndOrLump::applyOp(), RuleNegateIdentity::applyOp(), RuleShiftBitops::applyOp(), RuleEquality::applyOp(), RuleHighOrderAnd::applyOp(), RuleDoubleLoad::applyOp(), RuleLessOne::applyOp(), RuleRangeMeld::applyOp(), RuleFloatRange::applyOp(), RuleAndPiece::applyOp(), RuleAndCompare::applyOp(), RuleDoubleSub::applyOp(), RuleDoubleShift::applyOp(), RuleDoubleArithShift::applyOp(), RuleConcatShift::applyOp(), RuleLeftRight::applyOp(), RuleShiftCompare::applyOp(), RuleTrivialArith::applyOp(), RuleTrivialBool::applyOp(), RuleZextEliminate::applyOp(), RuleZextSless::applyOp(), RuleBitUndistribute::applyOp(), RuleBoolZext::applyOp(), RuleSborrow::applyOp(), RuleTrivialShift::applyOp(), RuleSignShift::applyOp(), RuleTestSign::applyOp(), RuleShift2Mult::applyOp(), RuleTransformCpool::applyOp(), Rule2Comp2Mult::applyOp(), RuleCarryElim::applyOp(), RuleSub2Add::applyOp(), RuleXorCollapse::applyOp(), RuleAddMultCollapse::applyOp(), RuleSubExtComm::applyOp(), RuleSubCommute::applyOp(), RuleConcatCommute::applyOp(), RuleZextShiftZext::applyOp(), RuleConcatZero::applyOp(), RuleConcatLeftShift::applyOp(), RuleSubZext::applyOp(), RuleSubCancel::applyOp(), RuleShiftSub::applyOp(), RuleHumptyDumpty::applyOp(), RuleDumptyHump::applyOp(), RuleHumptyOr::applyOp(), RuleEmbed::applyOp(), RuleLess2Zero::applyOp(), RuleLessEqual2Zero::applyOp(), RuleSLess2Zero::applyOp(), RuleEqual2Constant::applyOp(), RulePtrArith::applyOp(), RuleStructOffset0::applyOp(), RuleAddUnsigned::applyOp(), RuleSubRight::applyOp(), RulePtrsubCharConstant::applyOp(), RuleSubNormal::applyOp(), RuleDivTermAdd::applyOp(), RuleDivTermAdd2::applyOp(), RuleDivOpt::applyOp(), RuleSignDiv2::applyOp(), RuleSignForm::applyOp(), RuleSignNearMult::applyOp(), RuleModOpt::applyOp(), RuleSegment::applyOp(), RuleConditionalMove::applyOp(), RuleIgnoreNan::applyOp(), RuleThreeWayCompare::applyOp(), RulePopcountBoolXor::applyOp(), FlowInfo::artificialHalt(), AddTreeState::buildExtra(), FuncCallSpecs::buildInputFromTrials(), AddTreeState::buildMultiples(), FuncCallSpecs::buildOutputFromTrials(), FuncCallSpecs::buildParam(), RulePullsubMulti::buildSubpiece(), AddTreeState::buildTree(), FuncCallSpecs::checkInputTrialUse(), collapseIntMultMult(), FuncCallSpecs::commitNewOutputs(), RuleConditionalMove::BoolExpress::constructBool(), TransformVar::createReplacement(), createStackRef(), cseElimination(), descend2Undef(), distributeIntMultAdd(), SubvariableFlow::doReplacement(), fillinReadOnly(), JumpBasic::foldInOneGuard(), SubvariableFlow::getReplaceVarnode(), ActionDeadCode::neverConsumed(), newIndirectCreation(), nodeSplitInputPatch(), numVarnodes(), opSetInput(), opUndoPtradd(), overrideFlow(), ActionConditionalConst::propagateConstant(), RulePtrsubCharConstant::pushConstFurther(), RulePullsubMulti::replaceDescendants(), replaceLessequal(), replaceVolatile(), spacebaseConstant(), totalReplaceConstant(), RulePtrFlow::truncatePointer(), and SegmentOp::unify().
| PcodeOp * Funcdata::newIndirectCreation | ( | PcodeOp * | indeffect, |
| const Address & | addr, | ||
| int4 | size, | ||
| bool | possibleout | ||
| ) |
Build a CPUI_INDIRECT op that indirectly creates a Varnode.
An indirectly created Varnode effectively has no data-flow before the INDIRECT op that defines it, and the value contained by the Varnode is not explicitly calculable. The new Varnode is allocated with a given storage range.
| indeffect | is the p-code causing the indirect effect |
| addr | is the starting address of the given storage range |
| size | is the number of bytes in the storage range |
| possibleout | is true if the output should be treated as a directwrite. |
References CPUI_INDIRECT, PcodeOp::flags, Varnode::flags, PcodeOp::getAddr(), PcodeOp::indirect_creation, Varnode::indirect_creation, newConstant(), newOp(), newVarnodeIop(), newVarnodeOut(), opInsertBefore(), opSetInput(), and opSetOpcode().
Referenced by RulePullsubIndirect::applyOp(), FuncCallSpecs::commitNewOutputs(), and getMerge().
| PcodeOp * Funcdata::newIndirectOp | ( | PcodeOp * | indeffect, |
| const Address & | addr, | ||
| int4 | size, | ||
| uint4 | extraFlags | ||
| ) |
Find a representative CPUI_RETURN op for this function.
Create a new CPUI_INDIRECT around a PcodeOp with an indirect effect.
Typically this is used to annotate data-flow, for the given storage range, passing through a CALL or STORE. An output Varnode is automatically created.
| indeffect | is the PcodeOp with the indirect effect |
| addr | is the starting address of the storage range to protect |
| size | is the number of bytes in the storage range |
| extraFlags | are extra boolean properties to put on the INDIRECT |
References CPUI_INDIRECT, PcodeOp::flags, PcodeOp::getAddr(), newOp(), newVarnode(), newVarnodeIop(), newVarnodeOut(), opInsertBefore(), opSetInput(), and opSetOpcode().
Referenced by getMerge().
| inputs | is the number of operands the new op will have |
| pc | is the Address associated with the new op |
References PcodeOpBank::create(), and obank.
Referenced by adjustInputVarnodes(), ActionConstbase::apply(), ActionPrototypeTypes::apply(), ActionExtraPopSetup::apply(), RuleCollectTerms::applyOp(), RuleOrPredicate::applyOp(), RulePullsubMulti::applyOp(), RulePullsubIndirect::applyOp(), RulePushMulti::applyOp(), RuleNotDistribute::applyOp(), RuleDoubleLoad::applyOp(), RuleAndDistribute::applyOp(), RuleAndCommute::applyOp(), RuleAndPiece::applyOp(), RuleAndCompare::applyOp(), RuleConcatShift::applyOp(), RuleShiftCompare::applyOp(), RuleBitUndistribute::applyOp(), RuleBoolZext::applyOp(), RuleSignShift::applyOp(), RuleShiftPiece::applyOp(), RuleSub2Add::applyOp(), RuleAddMultCollapse::applyOp(), RuleSubExtComm::applyOp(), RuleSubCommute::applyOp(), RuleConcatCommute::applyOp(), RuleConcatZext::applyOp(), RuleZextCommute::applyOp(), RuleZextShiftZext::applyOp(), RuleConcatZero::applyOp(), RuleConcatLeftShift::applyOp(), RuleHumptyOr::applyOp(), RuleEmbed::applyOp(), RuleCondNegate::applyOp(), RulePushPtr::applyOp(), RuleSubRight::applyOp(), RuleSubNormal::applyOp(), RuleDivTermAdd::applyOp(), RuleDivTermAdd2::applyOp(), RuleDivOpt::applyOp(), RuleSignNearMult::applyOp(), FlowInfo::artificialHalt(), FuncCallSpecs::buildInputFromTrials(), FuncCallSpecs::buildOutputFromTrials(), FuncCallSpecs::buildParam(), ActionReturnRecovery::buildReturnOutput(), RulePullsubMulti::buildSubpiece(), ActionSetCasts::castInput(), ActionSetCasts::castOutput(), cloneOp(), FuncCallSpecs::commitNewOutputs(), RuleConditionalMove::BoolExpress::constructBool(), RuleConditionalMove::constructNegate(), TransformOp::createReplacement(), createStackRef(), cseElimination(), descend2Undef(), distributeIntMultAdd(), SubvariableFlow::doReplacement(), ActionPrototypeTypes::extendInput(), ActionFuncLink::funcLinkOutput(), getMerge(), FlowInfo::inlineClone(), newIndirectCreation(), newIndirectOp(), newOpBefore(), nodeSplitCloneOp(), opStackLoad(), opStackStore(), opUndoPtradd(), overrideFlow(), pushMultiequals(), replaceVolatile(), spacebaseConstant(), splitUses(), totalReplaceConstant(), and RulePtrFlow::truncatePointer().
| PcodeOp * Funcdata::newOpBefore | ( | PcodeOp * | follow, |
| OpCode | opc, | ||
| Varnode * | in1, | ||
| Varnode * | in2, | ||
| Varnode * | in3 = (Varnode *)0 |
||
| ) |
Allocate a new PcodeOp with sequence number.
Create new PcodeOp with 2 or 3 given operands.
The new op will have a unique space output Varnode and will be inserted before the given follow op.
| follow | is the follow up to insert the new PcodeOp before |
| opc | is the op-code of the new PcodeOp |
| in1 | is the first operand |
| in2 | is the second operand |
| in3 | is the optional third param |
References PcodeOp::getAddr(), Varnode::getSize(), newOp(), newUniqueOut(), opInsertBefore(), opSetInput(), opSetOpcode(), and size.
Referenced by RuleStructOffset0::applyOp(), AddTreeState::buildExtra(), AddTreeState::buildMultiples(), AddTreeState::buildTree(), and getMerge().
Construct a new spacebase register for a given address space.
Given an address space, like stack, that is known to have a base register pointing to it, construct a Varnode representing that register.
| id | is the stack like address space |
References AddrSpace::getSpacebase(), and newVarnode().
Referenced by createStackRef(), and hasBadData().
Create a new temporary Varnode.
A new temporary register storage location is allocated from the unique address space
| s | is the size of the Varnode in bytes |
| ct | is an optional data-type to associated with the Varnode |
References assignHigh(), checkForLanedRegister(), VarnodeBank::createUnique(), Varnode::getAddr(), TypeFactory::getBase(), glb, minLanedSize, TYPE_UNKNOWN, Architecture::types, and vbank.
Referenced by RuleSubZext::applyOp(), RuleSubRight::applyOp(), ActionSetCasts::castOutput(), TransformVar::createReplacement(), SubvariableFlow::getReplaceVarnode(), numVarnodes(), pushMultiequals(), SubvariableFlow::replaceInput(), and replaceVolatile().
Create a new temporary output Varnode.
Allocate a new register from the unique address space and create a new Varnode object representing it as an output to the given PcodeOp
References assignHigh(), checkForLanedRegister(), VarnodeBank::createDefUnique(), Varnode::getAddr(), TypeFactory::getBase(), glb, minLanedSize, PcodeOp::setOutput(), TYPE_UNKNOWN, Architecture::types, and vbank.
Referenced by RuleCollectTerms::applyOp(), RuleOrPredicate::applyOp(), RulePushMulti::applyOp(), RuleNotDistribute::applyOp(), RuleDoubleLoad::applyOp(), RuleAndDistribute::applyOp(), RuleAndCommute::applyOp(), RuleAndPiece::applyOp(), RuleAndCompare::applyOp(), RuleConcatShift::applyOp(), RuleShiftCompare::applyOp(), RuleBitUndistribute::applyOp(), RuleBoolZext::applyOp(), RuleSignShift::applyOp(), RuleShiftPiece::applyOp(), RuleSub2Add::applyOp(), RuleAddMultCollapse::applyOp(), RuleSubExtComm::applyOp(), RuleSubCommute::applyOp(), RuleConcatCommute::applyOp(), RuleConcatZext::applyOp(), RuleZextCommute::applyOp(), RuleZextShiftZext::applyOp(), RuleConcatZero::applyOp(), RuleConcatLeftShift::applyOp(), RuleHumptyOr::applyOp(), RuleEmbed::applyOp(), RuleCondNegate::applyOp(), RulePushPtr::applyOp(), RuleSubNormal::applyOp(), RuleDivTermAdd::applyOp(), RuleDivTermAdd2::applyOp(), RuleDivOpt::applyOp(), RuleSignNearMult::applyOp(), FuncCallSpecs::buildParam(), RulePullsubMulti::buildSubpiece(), RuleSubCommute::cancelExtensions(), ActionSetCasts::castInput(), RuleConditionalMove::BoolExpress::constructBool(), RuleConditionalMove::constructNegate(), TransformVar::createReplacement(), createStackRef(), descend2Undef(), distributeIntMultAdd(), SubvariableFlow::doReplacement(), newOpBefore(), numVarnodes(), opStackLoad(), opUndoPtradd(), replaceVolatile(), spacebaseConstant(), totalReplaceConstant(), and RulePtrFlow::truncatePointer().
Create a new unattached Varnode object.
| s | is the size of the new Varnode in bytes |
| m | is the storage Address of the Varnode |
| ct | is a data-type to associate with the Varnode |
References assignHigh(), checkForLanedRegister(), VarnodeBank::create(), Varnode::getAddr(), TypeFactory::getBase(), Varnode::getSize(), glb, localmap, minLanedSize, Scope::queryProperties(), Varnode::setFlags(), Varnode::setSymbolProperties(), TYPE_UNKNOWN, Varnode::typelock, Architecture::types, and vbank.
Referenced by adjustInputVarnodes(), ActionPrototypeTypes::apply(), ActionExtraPopSetup::apply(), ActionInputPrototype::apply(), RuleCollapseConstants::applyOp(), RuleLoadVarnode::applyOp(), RuleEqual2Zero::applyOp(), FuncCallSpecs::buildInputFromTrials(), FuncCallSpecs::buildOutputFromTrials(), FuncCallSpecs::buildParam(), TransformVar::createReplacement(), ActionFuncLink::funcLinkInput(), ActionFuncLink::funcLinkOutput(), SubvariableFlow::getReplaceVarnode(), newIndirectOp(), newSpacebasePtr(), newVarnode(), numVarnodes(), opZeroMulti(), pushMultiequals(), and splitUses().
| Varnode * Funcdata::newVarnodeCallSpecs | ( | FuncCallSpecs * | fc | ) |
Create a call specification annotation Varnode.
A call specification (FuncCallSpecs) is encoded into an annotation Varnode. The Varnode is used specifically as an input to CPUI_CALL ops to speed up access to their associated call specification.
| fc | is the call specification to encode |
References assignHigh(), VarnodeBank::create(), TypeFactory::getBase(), AddrSpaceManager::getFspecSpace(), glb, TYPE_UNKNOWN, Architecture::types, and vbank.
Referenced by FuncCallSpecs::deindirect(), numVarnodes(), FlowInfo::setupCallindSpecs(), FlowInfo::setupCallSpecs(), and truncatedFlow().
Create a PcodeOp annotation Varnode.
Create a special annotation Varnode that holds a pointer reference to a specific PcodeOp. This is used specifically to let a CPUI_INDIRECT op refer to the PcodeOp it is holding an indirect effect for.
| op | is the PcodeOp to encode in the annotation |
References assignHigh(), VarnodeBank::create(), TypeFactory::getBase(), AddrSpaceManager::getIopSpace(), glb, TYPE_UNKNOWN, Architecture::types, and vbank.
Referenced by ActionExtraPopSetup::apply(), RulePullsubIndirect::applyOp(), TransformVar::createReplacement(), newIndirectCreation(), newIndirectOp(), and numVarnodes().
Create a new output Varnode.
Create a new Varnode which is already defined as output of a given PcodeOp. This if more efficient as it avoids the initial insertion of the free form of the Varnode into the tree, and queryProperties only needs to be called once.
| s | is the size of the new Varnode in bytes |
| m | is the storage Address of the Varnode |
| op | is the given PcodeOp whose output is created |
References assignHigh(), checkForLanedRegister(), VarnodeBank::createDef(), PcodeOp::getAddr(), TypeFactory::getBase(), glb, localmap, minLanedSize, Scope::queryProperties(), Varnode::setFlags(), PcodeOp::setOutput(), Varnode::setSymbolProperties(), TYPE_UNKNOWN, Varnode::typelock, Architecture::types, and vbank.
Referenced by adjustInputVarnodes(), ActionConstbase::apply(), ActionPrototypeTypes::apply(), ActionExtraPopSetup::apply(), RulePullsubMulti::applyOp(), RulePullsubIndirect::applyOp(), RulePushMulti::applyOp(), RuleLeftRight::applyOp(), RuleStoreVarnode::applyOp(), FuncCallSpecs::buildInputFromTrials(), ActionReturnRecovery::buildReturnOutput(), RulePullsubMulti::buildSubpiece(), FuncCallSpecs::commitNewOutputs(), TransformVar::createReplacement(), cseElimination(), ActionPrototypeTypes::extendInput(), ActionFuncLink::funcLinkOutput(), newIndirectCreation(), newIndirectOp(), nodeSplitCloneVarnode(), numVarnodes(), and RulePtrFlow::truncatePointer().
Create a constant Varnode referring to an address space.
A reference to a particular address space is encoded as a constant Varnode. These are used for LOAD and STORE p-code ops in particular.
| spc | is the address space to encode |
References assignHigh(), VarnodeBank::create(), AddrSpaceManager::createConstFromSpace(), TypeFactory::getBase(), glb, TYPE_UNKNOWN, Architecture::types, and vbank.
Referenced by ActionSegmentize::apply(), RuleDoubleLoad::applyOp(), createStackRef(), numVarnodes(), opStackLoad(), and opStackStore().
| BlockBasic * Funcdata::nodeJoinCreateBlock | ( | BlockBasic * | block1, |
| BlockBasic * | block2, | ||
| BlockBasic * | exita, | ||
| BlockBasic * | exitb, | ||
| bool | fora_block1ishigh, | ||
| bool | forb_block1ishigh, | ||
| const Address & | addr | ||
| ) |
Create a new basic block for holding a merged CBRANCH.
This is used by ConditionalJoin to do the low-level control-flow manipulation to merge identical conditional branches. Given basic blocks containing the two CBRANCH ops to merge, the new block gets one of the two out edges from each block, and the remaining out edges are changed to point into the new block.
| block1 | is the basic block containing the first CBRANCH to merge |
| block2 | is the basic block containing the second CBRANCH |
| exita | is the first common exit block for the CBRANCHs |
| exitb | is the second common exit block |
| fora_block1ishigh | designates which edge is moved for exita |
| forb_block1ishigh | designates which edge is moved for exitb |
| addr | is the Address associated with (1 of the) CBRANCH ops |
References BlockGraph::addEdge(), bblocks, FlowBlock::f_joined_block, FlowBlock::getOutIndex(), BlockGraph::moveOutEdge(), BlockGraph::newBlockBasic(), BlockGraph::removeEdge(), FlowBlock::setFlag(), BlockBasic::setInitialRange(), and structureReset().
Referenced by setBasicBlockRange().
| void Funcdata::nodeSplit | ( | BlockBasic * | b, |
| int4 | inedge | ||
| ) |
Split control-flow into a basic block, duplicating its p-code into a new block.
P-code is duplicated into another block, and control-flow is modified so that the new block takes over flow from one input edge to the original block.
| b | is the basic block to be duplicated and split |
| inedge | is the index of the input edge to move to the duplicate block |
References FlowBlock::clearMark(), FlowBlock::getIn(), FlowBlock::isMark(), nodeSplitBlockEdge(), nodeSplitInputPatch(), nodeSplitRawDuplicate(), FlowBlock::setMark(), FlowBlock::sizeIn(), FlowBlock::sizeOut(), and structureReset().
Referenced by ActionReturnSplit::apply(), and setBasicBlockRange().
|
private |
Split given basic block b along an in edge.
A copy of the block is made, inheriting the same out edges but only the one indicated in edge, which is removed from the original block. Other data-flow is not affected.
| b | is the given basic block |
| inedge | is the index of the indicated in edge |
References BlockGraph::addEdge(), bblocks, BlockBasic::copyRange(), FlowBlock::f_duplicate_block, FlowBlock::getIn(), FlowBlock::getOut(), BlockGraph::newBlockBasic(), FlowBlock::setFlag(), FlowBlock::sizeOut(), and BlockGraph::switchEdge().
Referenced by nodeSplit().
Duplicate the given PcodeOp as part of splitting a block.
Make a basic clone of the p-code op copying its basic control-flow properties
| op | is the given PcodeOp |
References PcodeOp::code(), CPUI_BRANCH, flags, PcodeOp::flags, PcodeOp::getAddr(), PcodeOp::isBranch(), newOp(), PcodeOp::nocollapse, PcodeOp::numInput(), opSetOpcode(), PcodeOp::setFlag(), PcodeOp::startbasic, and PcodeOp::startmark.
Referenced by nodeSplitRawDuplicate().
Duplicate output Varnode of the given p-code op, as part of splitting a block.
Make a basic clone of the Varnode and its basic flags. The clone is created as an output of a previously cloned PcodeOp.
| op | is the given op whose output should be cloned |
| newop | is the cloned version |
References Varnode::addrforce, Varnode::addrtied, Varnode::externref, Varnode::getAddr(), Varnode::getFlags(), PcodeOp::getOut(), Varnode::getSize(), Varnode::incidental_copy, newVarnodeOut(), Varnode::persist, Varnode::readonly, Varnode::setFlags(), and Varnode::volatil.
Referenced by nodeSplitRawDuplicate().
|
private |
Patch Varnode inputs to p-code ops in split basic block.
Map Varnodes that are inputs for PcodeOps in the original basic block to the input slots of the cloned ops in the split block. Constants and code ref Varnodes need to be duplicated, other Varnodes are shared between the ops. This routine also pulls an input Varnode out of riginal MULTIEQUAL ops and adds it back to the cloned MULTIEQUAL ops.
| b | is the original basic block |
| bprime | is the split clone of the block |
| inedge | is the incoming edge index that was split on |
References BlockBasic::beginOp(), PcodeOp::code(), CPUI_COPY, CPUI_INDIRECT, CPUI_MULTIEQUAL, BlockBasic::endOp(), Varnode::getAddr(), Varnode::getDef(), PcodeOp::getIn(), Varnode::getOffset(), PcodeOp::getOut(), PcodeOp::getParent(), Varnode::getSize(), Varnode::isAnnotation(), PcodeOp::isCall(), Varnode::isConstant(), Varnode::isFree(), Varnode::isWritten(), newCodeRef(), newConstant(), PcodeOp::numInput(), opRemoveInput(), opSetInput(), opSetOpcode(), and PcodeOp::setNumInputs().
Referenced by nodeSplit().
|
private |
Clone all p-code ops from a block into its copy.
P-code in a basic block is cloned into the split version of the block. Only the output Varnodes are cloned, not the inputs.
| b | is the original basic block |
| bprime | is the cloned block |
References BlockBasic::beginOp(), BlockBasic::endOp(), nodeSplitCloneOp(), nodeSplitCloneVarnode(), and opInsertEnd().
Referenced by nodeSplit().
|
inline |
Get the number of heritage passes performed for the given address space.
| spc | is the address space |
References Heritage::numHeritagePasses().
| bool Funcdata::onlyOpUse | ( | const Varnode * | invn, |
| const PcodeOp * | opmatch, | ||
| const ParamTrial & | trial | ||
| ) | const |
Test if the given Varnode seems to only be used by a CALL.
Part of testing whether a Varnode makes sense as parameter passing storage is looking for different explicit uses.
| invn | is the given Varnode |
| opmatch | is the putative CALL op using the Varnode for parameter passing |
| trial | is the parameter trial object associated with the Varnode |
References checkCallDoubleUse(), PcodeOp::code(), CPUI_BRANCH, CPUI_BRANCHIND, CPUI_CALL, CPUI_CALLIND, CPUI_CBRANCH, CPUI_LOAD, CPUI_RETURN, CPUI_STORE, Varnode::descend, PcodeOp::getIn(), PcodeOp::getOut(), ParamTrial::getSlot(), Varnode::isMark(), Varnode::isPersist(), and Varnode::setMark().
Referenced by ancestorOpUse(), and clearLanedAccessMap().
| void Funcdata::opDestroy | ( | PcodeOp * | op | ) |
Remove given PcodeOp and destroy its Varnode operands.
All input and output Varnodes to the op are destroyed (their object resources freed), and the op is permanently moved to the dead list. To call this routine, make sure that either:
| op | is the given PcodeOp |
References destroyVarnode(), PcodeOp::getIn(), PcodeOp::getOut(), PcodeOp::getParent(), PcodeOpBank::markDead(), PcodeOp::numInput(), obank, opUnsetInput(), and BlockBasic::removeOp().
Referenced by ActionDeadCode::apply(), RuleEarlyRemoval::applyOp(), RulePushMulti::applyOp(), RuleIndirectCollapse::applyOp(), RuleMultiCollapse::applyOp(), RuleSubCommute::applyOp(), Rule2Comp2Sub::applyOp(), RulePtrsubCharConstant::applyOp(), blockRemoveInternal(), branchRemoveInternal(), FuncCallSpecs::buildOutputFromTrials(), AddTreeState::buildTree(), cseElimination(), JumpAssisted::foldInNormalization(), ActionDeadCode::neverConsumed(), opFlipInPlaceExecute(), opHeritage(), ActionMultiCse::processBlock(), TransformManager::removeOld(), and spliceBlockBasic().
| void Funcdata::opDestroyRaw | ( | PcodeOp * | op | ) |
Remove the given raw PcodeOp.
This is a specialized routine for deleting an op during flow generation that has been replaced by something else. The op is expected to be dead with none of its inputs or outputs linked to anything else. Both the PcodeOp and all the input/output Varnodes are destroyed.
| op | is the given PcodeOp |
References PcodeOpBank::destroy(), destroyVarnode(), PcodeOp::getIn(), PcodeOp::getOut(), PcodeOp::numInput(), and obank.
Referenced by FlowInfo::deleteRemainingOps(), FlowInfo::doInjection(), inlineFlow(), and opHeritage().
| void Funcdata::opInsert | ( | PcodeOp * | op, |
| BlockBasic * | bl, | ||
| list< PcodeOp * >::iterator | iter | ||
| ) |
Insert the given PcodeOp at specific point in a basic block.
The PcodeOp is removed from the dead list and is inserted immediately before the specified iterator.
| op | is the given PcodeOp |
| bl | is the basic block being inserted into |
| iter | indicates exactly where the op is inserted |
References BlockBasic::insert(), PcodeOpBank::markAlive(), and obank.
Referenced by doLiveInject(), opHeritage(), opInsertAfter(), opInsertBefore(), opInsertBegin(), opInsertEnd(), and FlowInfo::splitBasic().
Insert given PcodeOp after a specific op.
The given PcodeOp is inserted immediately after the prev op except:
| op | is the given PcodeOp to insert |
| prev | is the op to insert after |
References PcodeOp::code(), CPUI_INDIRECT, CPUI_MULTIEQUAL, BlockBasic::endOp(), Varnode::getAddr(), PcodeOp::getBasicIter(), PcodeOp::getIn(), PcodeOp::getOpFromConst(), PcodeOp::getParent(), Varnode::getSpace(), AddrSpace::getType(), IPTR_IOP, PcodeOp::isDead(), PcodeOp::isMarker(), and opInsert().
Referenced by ActionExtraPopSetup::apply(), RulePushMulti::applyOp(), RuleDoubleLoad::applyOp(), FuncCallSpecs::buildOutputFromTrials(), RulePullsubMulti::buildSubpiece(), ActionSetCasts::castOutput(), FuncCallSpecs::commitNewOutputs(), createStackRef(), SubvariableFlow::doReplacement(), findOp(), ActionFuncLink::funcLinkOutput(), opStackLoad(), opStackStore(), replaceVolatile(), and totalReplaceConstant().
Insert given PcodeOp before a specific op.
The given PcodeOp is inserted immediately before the follow op except:
| op | is the given PcodeOp to insert |
| follow | is the op to insert before |
References BlockBasic::beginOp(), PcodeOp::code(), CPUI_INDIRECT, PcodeOp::getBasicIter(), PcodeOp::getParent(), and opInsert().
Referenced by ActionExtraPopSetup::apply(), RuleCollectTerms::applyOp(), RulePullsubIndirect::applyOp(), RuleNotDistribute::applyOp(), RuleAndDistribute::applyOp(), RuleAndCommute::applyOp(), RuleAndPiece::applyOp(), RuleAndCompare::applyOp(), RuleConcatShift::applyOp(), RuleShiftCompare::applyOp(), RuleBitUndistribute::applyOp(), RuleBoolZext::applyOp(), RuleSignShift::applyOp(), RuleShiftPiece::applyOp(), RuleSub2Add::applyOp(), RuleAddMultCollapse::applyOp(), RuleSubExtComm::applyOp(), RuleSubCommute::applyOp(), RuleConcatCommute::applyOp(), RuleConcatZext::applyOp(), RuleZextCommute::applyOp(), RuleZextShiftZext::applyOp(), RuleConcatZero::applyOp(), RuleConcatLeftShift::applyOp(), RuleHumptyOr::applyOp(), RuleEmbed::applyOp(), RuleCondNegate::applyOp(), RulePushPtr::applyOp(), RuleSubRight::applyOp(), RuleSubNormal::applyOp(), RuleDivTermAdd::applyOp(), RuleDivTermAdd2::applyOp(), RuleDivOpt::applyOp(), RuleSignNearMult::applyOp(), TransformOp::attemptInsertion(), FuncCallSpecs::buildInputFromTrials(), FuncCallSpecs::buildParam(), ActionReturnRecovery::buildReturnOutput(), ActionSetCasts::castInput(), RuleConditionalMove::BoolExpress::constructBool(), RuleConditionalMove::constructNegate(), TransformOp::createReplacement(), createStackRef(), descend2Undef(), distributeIntMultAdd(), SubvariableFlow::doReplacement(), findOp(), newIndirectCreation(), newIndirectOp(), newOpBefore(), opUndoPtradd(), replaceVolatile(), spacebaseConstant(), splitUses(), and RulePtrFlow::truncatePointer().
| void Funcdata::opInsertBegin | ( | PcodeOp * | op, |
| BlockBasic * | bl | ||
| ) |
Insert given PcodeOp at the beginning of a basic block.
The given PcodeOp is inserted as the first op in the basic block except:
| op | is the given PcodeOp to insert |
| bl | is the basic block to insert into |
References BlockBasic::beginOp(), PcodeOp::code(), CPUI_MULTIEQUAL, BlockBasic::endOp(), and opInsert().
Referenced by adjustInputVarnodes(), ActionConstbase::apply(), ActionPrototypeTypes::apply(), RuleOrPredicate::applyOp(), RulePullsubMulti::applyOp(), RulePushMulti::applyOp(), RuleMultiCollapse::applyOp(), RuleConditionalMove::applyOp(), TransformOp::attemptInsertion(), RulePullsubMulti::buildSubpiece(), TransformOp::createReplacement(), ActionPrototypeTypes::extendInput(), findOp(), pushMultiequals(), and totalReplaceConstant().
| void Funcdata::opInsertEnd | ( | PcodeOp * | op, |
| BlockBasic * | bl | ||
| ) |
Insert given PcodeOp at the end of a basic block.
The given PcodeOp is inserted as the last op in the basic block except:
| op | is the given PcodeOp to insert |
| bl | is the basic block to insert into |
References BlockBasic::beginOp(), BlockBasic::endOp(), and opInsert().
Referenced by cseElimination(), descend2Undef(), findOp(), and nodeSplitRawDuplicate().
Insert a new Varnode into the operand list for the given PcodeOp.
The given Varnode is set into the given operand slot. Any existing input Varnodes with slot indices equal to or greater than the specified slot are pushed into the next slot.
| op | is the given PcodeOp |
| vn | is the given Varnode to insert |
| slot | is the input index to insert at |
References PcodeOp::insertInput(), and opSetInput().
Referenced by ActionPrototypeTypes::apply(), ActionParamDouble::apply(), RuleNotDistribute::applyOp(), RuleTransformCpool::applyOp(), Rule2Comp2Mult::applyOp(), RuleZextShiftZext::applyOp(), RuleSubZext::applyOp(), blockRemoveInternal(), TransformOp::createReplacement(), ActionFuncLink::funcLinkInput(), opDeadAndGone(), and opZeroMulti().
| void Funcdata::opMarkHalt | ( | PcodeOp * | op, |
| uint4 | flag | ||
| ) |
Mark given CPUI_RETURN op as a special halt.
| op | is the given CPUI_RETURN op |
| flag | is one of halt, badinstruction, unimplemented, noreturn, or missing. |
References PcodeOp::badinstruction, PcodeOp::code(), CPUI_RETURN, PcodeOp::halt, PcodeOp::missing, PcodeOp::noreturn, PcodeOp::setFlag(), and PcodeOp::unimplemented.
Referenced by FlowInfo::artificialHalt(), and opHeritage().
| void Funcdata::opRemoveInput | ( | PcodeOp * | op, |
| int4 | slot | ||
| ) |
Remove a specific input slot for the given PcodeOp.
The Varnode in the specified slot is unlinked from the op and the slot itself is removed. The slot index for any remaining input Varnodes coming after the specified slot is decreased by one.
| op | is the given PcodeOp |
| slot | is the index of the specified slot to remove |
References opUnsetInput(), and PcodeOp::removeInput().
Referenced by FuncCallSpecs::abortSpacebaseRelative(), ActionStackPtrFlow::adjustLoad(), ActionSegmentize::apply(), ActionSetCasts::apply(), ActionParamDouble::apply(), RulePiece2Zext::applyOp(), RulePiece2Sext::applyOp(), RuleOrMask::applyOp(), RuleAndMask::applyOp(), RuleOrConsume::applyOp(), RuleOrCollapse::applyOp(), RuleNegateIdentity::applyOp(), RuleOrPredicate::applyOp(), RuleEquality::applyOp(), RuleHighOrderAnd::applyOp(), RuleDoubleLoad::applyOp(), RuleRangeMeld::applyOp(), RuleDoubleShift::applyOp(), RuleConcatShift::applyOp(), RuleLeftRight::applyOp(), RuleLessEqual::applyOp(), RuleTrivialArith::applyOp(), RuleTrivialBool::applyOp(), RuleBitUndistribute::applyOp(), RuleBooleanNegate::applyOp(), RuleBoolZext::applyOp(), RuleIndirectCollapse::applyOp(), RuleSborrow::applyOp(), RuleTrivialShift::applyOp(), RuleIdentityEl::applyOp(), RuleShiftPiece::applyOp(), RuleCollapseConstants::applyOp(), RuleTransformCpool::applyOp(), RuleCarryElim::applyOp(), RuleLoadVarnode::applyOp(), RuleStoreVarnode::applyOp(), RuleSubExtComm::applyOp(), RuleConcatZext::applyOp(), RuleZextCommute::applyOp(), RuleShiftAnd::applyOp(), RuleSubCancel::applyOp(), RuleHumptyDumpty::applyOp(), RuleDumptyHump::applyOp(), RuleHumptyOr::applyOp(), RuleLess2Zero::applyOp(), RuleLessEqual2Zero::applyOp(), RuleMultNegOne::applyOp(), RulePtrsubCharConstant::applyOp(), RuleSegment::applyOp(), RuleConditionalMove::applyOp(), RuleIgnoreNan::applyOp(), RuleFuncPtrEncoding::applyOp(), RulePopcountBoolXor::applyOp(), RuleXorSwap::applyOp(), blockRemoveInternal(), branchRemoveInternal(), RuleOrPredicate::checkSingle(), FuncCallSpecs::commitNewOutputs(), TransformOp::createReplacement(), SubvariableFlow::doReplacement(), fillinReadOnly(), inlineFlow(), nodeSplitInputPatch(), opDeadAndGone(), opUndoPtradd(), FuncCallSpecs::paramshiftModifyStop(), pushBranch(), RulePtrsubCharConstant::pushConstFurther(), RulePullsubMulti::replaceDescendants(), and FuncCallSpecs::resolveSpacebaseRelative().
Set all input Varnodes for the given PcodeOp simultaneously.
All previously existing input Varnodes are unset. The input slots for the op are resized and then filled in from the specified array.
| op | is the given PcodeOp to set |
| vvec | is the specified array of new input Varnodes |
References PcodeOp::getIn(), PcodeOp::numInput(), opSetInput(), opUnsetInput(), and PcodeOp::setNumInputs().
Referenced by ActionStackPtrFlow::analyzeExtraPop(), ActionShadowVar::apply(), RulePullsubMulti::applyOp(), RuleMultiCollapse::applyOp(), RulePtrArith::applyOp(), FuncCallSpecs::buildInputFromTrials(), ActionReturnRecovery::buildReturnOutput(), FuncCallSpecs::commitNewInputs(), SubvariableFlow::doReplacement(), opDeadAndGone(), and pushMultiequals().
Set a specific input operand for the given PcodeOp.
| op | is the given PcodeOp |
| vn | is the operand Varnode to set |
| slot | is the input slot where the Varnode is placed |
References Varnode::addDescend(), Varnode::copySymbol(), PcodeOp::getIn(), Varnode::getOffset(), Varnode::getSize(), Varnode::hasNoDescend(), Varnode::isConstant(), Varnode::isSpacebase(), newConstant(), opUnsetInput(), and PcodeOp::setInput().
Referenced by adjustInputVarnodes(), ActionStackPtrFlow::adjustLoad(), ActionSegmentize::apply(), ActionConstbase::apply(), ActionPrototypeTypes::apply(), ActionExtraPopSetup::apply(), ActionParamDouble::apply(), ActionLikelyTrash::apply(), RuleCollectTerms::applyOp(), RuleOrMask::applyOp(), RuleAndMask::applyOp(), RuleAndOrLump::applyOp(), RuleNegateIdentity::applyOp(), RuleShiftBitops::applyOp(), RuleRightShiftAnd::applyOp(), RuleOrPredicate::applyOp(), RuleEquality::applyOp(), RulePullsubIndirect::applyOp(), RulePushMulti::applyOp(), RuleNotDistribute::applyOp(), RuleHighOrderAnd::applyOp(), RuleDoubleLoad::applyOp(), RuleAndDistribute::applyOp(), RuleLessOne::applyOp(), RuleRangeMeld::applyOp(), RuleFloatRange::applyOp(), RuleAndCommute::applyOp(), RuleAndPiece::applyOp(), RuleAndCompare::applyOp(), RuleDoubleSub::applyOp(), RuleDoubleShift::applyOp(), RuleDoubleArithShift::applyOp(), RuleConcatShift::applyOp(), RuleLeftRight::applyOp(), RuleShiftCompare::applyOp(), RuleLessEqual::applyOp(), RuleLessNotEqual::applyOp(), RuleTrivialArith::applyOp(), RuleTrivialBool::applyOp(), RuleZextEliminate::applyOp(), RuleZextSless::applyOp(), RuleBitUndistribute::applyOp(), RuleBooleanNegate::applyOp(), RuleBoolZext::applyOp(), RuleIndirectCollapse::applyOp(), RuleSborrow::applyOp(), RuleTrivialShift::applyOp(), RuleSignShift::applyOp(), RuleTestSign::applyOp(), RuleShift2Mult::applyOp(), RuleShiftPiece::applyOp(), RuleCollapseConstants::applyOp(), RuleTransformCpool::applyOp(), RulePropagateCopy::applyOp(), RuleCarryElim::applyOp(), RuleSub2Add::applyOp(), RuleXorCollapse::applyOp(), RuleAddMultCollapse::applyOp(), RuleLoadVarnode::applyOp(), RuleSubExtComm::applyOp(), RuleSubCommute::applyOp(), RuleConcatCommute::applyOp(), RuleConcatZext::applyOp(), RuleZextCommute::applyOp(), RuleZextShiftZext::applyOp(), RuleConcatZero::applyOp(), RuleConcatLeftShift::applyOp(), RuleSubZext::applyOp(), RuleSubCancel::applyOp(), RuleShiftSub::applyOp(), RuleHumptyDumpty::applyOp(), RuleDumptyHump::applyOp(), RuleHumptyOr::applyOp(), RuleEmbed::applyOp(), RuleSwitchSingle::applyOp(), RuleCondNegate::applyOp(), RuleLess2Zero::applyOp(), RuleLessEqual2Zero::applyOp(), RuleSLess2Zero::applyOp(), RuleEqual2Zero::applyOp(), RuleEqual2Constant::applyOp(), RuleStructOffset0::applyOp(), RulePushPtr::applyOp(), RuleAddUnsigned::applyOp(), Rule2Comp2Sub::applyOp(), RuleSubRight::applyOp(), RulePtrsubCharConstant::applyOp(), RuleSubNormal::applyOp(), RuleDivTermAdd::applyOp(), RuleDivTermAdd2::applyOp(), RuleDivOpt::applyOp(), RuleSignDiv2::applyOp(), RuleSignForm::applyOp(), RuleSignNearMult::applyOp(), RuleModOpt::applyOp(), RuleSegment::applyOp(), RuleNegateNegate::applyOp(), RuleConditionalMove::applyOp(), RuleFloatCast::applyOp(), RuleIgnoreNan::applyOp(), RuleThreeWayCompare::applyOp(), RulePopcountBoolXor::applyOp(), RuleXorSwap::applyOp(), FlowInfo::artificialHalt(), FuncCallSpecs::buildInputFromTrials(), FuncCallSpecs::buildOutputFromTrials(), FuncCallSpecs::buildParam(), ActionReturnRecovery::buildReturnOutput(), RulePullsubMulti::buildSubpiece(), RuleSubCommute::cancelExtensions(), ActionSetCasts::castInput(), ActionSetCasts::castOutput(), FlowInfo::checkContainedCall(), FuncCallSpecs::checkInputTrialUse(), RuleOrPredicate::checkSingle(), cloneOp(), collapseIntMultMult(), FuncCallSpecs::commitNewOutputs(), RuleConditionalMove::BoolExpress::constructBool(), RuleConditionalMove::constructNegate(), createStackRef(), cseElimination(), FuncCallSpecs::deindirect(), descend2Undef(), distributeIntMultAdd(), SubvariableFlow::doReplacement(), ActionPrototypeTypes::extendInput(), fillinReadOnly(), JumpBasic::foldInNormalization(), JumpAssisted::foldInNormalization(), JumpBasic::foldInOneGuard(), ActionFuncLink::funcLinkOutput(), FlowInfo::inlineClone(), inlineFlow(), RuleDivOpt::moveSignBitExtraction(), ActionDeadCode::neverConsumed(), newIndirectCreation(), newIndirectOp(), newOpBefore(), nodeSplitInputPatch(), opFlipInPlaceExecute(), opHeritage(), opInsertInput(), opSetAllInput(), opStackLoad(), opStackStore(), opUndoPtradd(), overrideFlow(), TransformManager::placeInputs(), ActionConditionalConst::propagateConstant(), RulePtrsubCharConstant::pushConstFurther(), pushMultiequals(), RulePullsubMulti::replaceDescendants(), replaceLessequal(), replaceVolatile(), FlowInfo::setupCallindSpecs(), FlowInfo::setupCallSpecs(), spacebaseConstant(), splitUses(), totalReplace(), totalReplaceConstant(), truncatedFlow(), and RulePtrFlow::truncatePointer().
Set the op-code for a specific PcodeOp.
| op | is the given PcodeOp |
| opc | is the op-code to set |
References PcodeOpBank::changeOpcode(), glb, Architecture::inst, and obank.
Referenced by adjustInputVarnodes(), ActionStackPtrFlow::adjustLoad(), ActionStackPtrFlow::analyzeExtraPop(), ActionSegmentize::apply(), ActionShadowVar::apply(), ActionConstbase::apply(), ActionSetCasts::apply(), ActionPrototypeTypes::apply(), ActionExtraPopSetup::apply(), RuleCollectTerms::applyOp(), RulePiece2Zext::applyOp(), RulePiece2Sext::applyOp(), RuleBxor2NotEqual::applyOp(), RuleOrMask::applyOp(), RuleAndMask::applyOp(), RuleOrConsume::applyOp(), RuleOrCollapse::applyOp(), RuleNegateIdentity::applyOp(), RuleOrPredicate::applyOp(), RuleEquality::applyOp(), RulePullsubMulti::applyOp(), RulePullsubIndirect::applyOp(), RulePushMulti::applyOp(), RuleNotDistribute::applyOp(), RuleHighOrderAnd::applyOp(), RuleDoubleLoad::applyOp(), RuleAndDistribute::applyOp(), RuleLessOne::applyOp(), RuleRangeMeld::applyOp(), RuleFloatRange::applyOp(), RuleAndCommute::applyOp(), RuleAndPiece::applyOp(), RuleAndCompare::applyOp(), RuleDoubleShift::applyOp(), RuleConcatShift::applyOp(), RuleLeftRight::applyOp(), RuleShiftCompare::applyOp(), RuleLessEqual::applyOp(), RuleLessNotEqual::applyOp(), RuleTrivialArith::applyOp(), RuleTrivialBool::applyOp(), RuleSlessToLess::applyOp(), RuleZextSless::applyOp(), RuleBitUndistribute::applyOp(), RuleBooleanNegate::applyOp(), RuleBoolZext::applyOp(), RuleLogic2Bool::applyOp(), RuleIndirectCollapse::applyOp(), RuleMultiCollapse::applyOp(), RuleSborrow::applyOp(), RuleTrivialShift::applyOp(), RuleSignShift::applyOp(), RuleTestSign::applyOp(), RuleIdentityEl::applyOp(), RuleShift2Mult::applyOp(), RuleShiftPiece::applyOp(), RuleCollapseConstants::applyOp(), RuleTransformCpool::applyOp(), Rule2Comp2Mult::applyOp(), RuleCarryElim::applyOp(), RuleSub2Add::applyOp(), RuleAddMultCollapse::applyOp(), RuleLoadVarnode::applyOp(), RuleStoreVarnode::applyOp(), RuleSubExtComm::applyOp(), RuleSubCommute::applyOp(), RuleConcatCommute::applyOp(), RuleConcatZext::applyOp(), RuleZextCommute::applyOp(), RuleZextShiftZext::applyOp(), RuleShiftAnd::applyOp(), RuleConcatZero::applyOp(), RuleConcatLeftShift::applyOp(), RuleSubZext::applyOp(), RuleSubCancel::applyOp(), RuleHumptyDumpty::applyOp(), RuleDumptyHump::applyOp(), RuleHumptyOr::applyOp(), RuleEmbed::applyOp(), RuleSwitchSingle::applyOp(), RuleCondNegate::applyOp(), RuleBoolNegate::applyOp(), RuleLess2Zero::applyOp(), RuleLessEqual2Zero::applyOp(), RuleSLess2Zero::applyOp(), RulePtrArith::applyOp(), RulePushPtr::applyOp(), RulePtrsubUndo::applyOp(), RuleMultNegOne::applyOp(), RuleAddUnsigned::applyOp(), Rule2Comp2Sub::applyOp(), RuleSubRight::applyOp(), RulePtrsubCharConstant::applyOp(), RuleSubNormal::applyOp(), RulePositiveDiv::applyOp(), RuleDivTermAdd::applyOp(), RuleDivTermAdd2::applyOp(), RuleDivOpt::applyOp(), RuleSignDiv2::applyOp(), RuleSignForm::applyOp(), RuleSignNearMult::applyOp(), RuleModOpt::applyOp(), RuleSegment::applyOp(), RuleNegateNegate::applyOp(), RuleConditionalMove::applyOp(), RuleFloatCast::applyOp(), RuleIgnoreNan::applyOp(), RuleFuncPtrEncoding::applyOp(), RuleThreeWayCompare::applyOp(), RulePopcountBoolXor::applyOp(), RuleXorSwap::applyOp(), FlowInfo::artificialHalt(), FuncCallSpecs::buildInputFromTrials(), FuncCallSpecs::buildOutputFromTrials(), FuncCallSpecs::buildParam(), ActionReturnRecovery::buildReturnOutput(), RulePullsubMulti::buildSubpiece(), ActionSetCasts::castInput(), ActionSetCasts::castOutput(), FlowInfo::checkContainedCall(), RuleOrPredicate::checkSingle(), cloneOp(), FuncCallSpecs::commitNewOutputs(), RuleConditionalMove::BoolExpress::constructBool(), RuleConditionalMove::constructNegate(), TransformOp::createReplacement(), createStackRef(), cseElimination(), FuncCallSpecs::deindirect(), descend2Undef(), distributeIntMultAdd(), SubvariableFlow::doReplacement(), ActionPrototypeTypes::extendInput(), fillinReadOnly(), ActionFuncLink::funcLinkOutput(), FlowInfo::inlineClone(), inlineFlow(), newIndirectCreation(), newIndirectOp(), newOpBefore(), nodeSplitCloneOp(), nodeSplitInputPatch(), opFlipInPlaceExecute(), opHeritage(), opStackLoad(), opStackStore(), opUndoPtradd(), opZeroMulti(), overrideFlow(), pushBranch(), RulePtrsubCharConstant::pushConstFurther(), pushMultiequals(), RulePullsubMulti::replaceDescendants(), replaceLessequal(), replaceVolatile(), FlowInfo::setupCallindSpecs(), spacebaseConstant(), splitUses(), totalReplaceConstant(), FlowInfo::truncateIndirectJump(), and RulePtrFlow::truncatePointer().
Set a specific output Varnode for the given PcodeOp.
References Varnode::getDef(), PcodeOp::getOut(), opUnsetOutput(), VarnodeBank::setDef(), PcodeOp::setOutput(), setVarnodeProperties(), and vbank.
Referenced by RulePushMulti::applyOp(), RuleSubCommute::applyOp(), RuleSubZext::applyOp(), RuleSubRight::applyOp(), FuncCallSpecs::buildOutputFromTrials(), AddTreeState::buildTree(), ActionSetCasts::castOutput(), cloneOp(), FuncCallSpecs::commitNewOutputs(), SubvariableFlow::doReplacement(), opHeritage(), pushMultiequals(), replaceVolatile(), and splitUses().
| Varnode * Funcdata::opStackLoad | ( | AddrSpace * | spc, |
| uintb | off, | ||
| uint4 | sz, | ||
| PcodeOp * | op, | ||
| Varnode * | stackref, | ||
| bool | insertafter | ||
| ) |
Create a LOAD expression at an offset relative to a spacebase register for a given address space.
The spacebase register is looked up for the given address space, or an optional previously existing register Varnode can be provided. An insertion point op must be provided, and newly generated ops can come either before or after this insertion point.
| spc | is the given address space |
| off | is the offset to calculate relative to the spacebase register |
| sz | is the size of the desire LOAD in bytes |
| op | is the insertion point PcodeOp |
| stackref | is the spacebase register Varnode (if available) |
| insertafter | is true if new ops are inserted after the insertion point |
References CPUI_LOAD, createStackRef(), PcodeOp::getAddr(), AddrSpace::getContain(), Varnode::getDef(), newOp(), newUniqueOut(), newVarnodeSpace(), opInsertAfter(), opSetInput(), and opSetOpcode().
Referenced by FuncCallSpecs::buildParam(), ActionFuncLink::funcLinkInput(), and target().
Create a STORE expression at an offset relative to a spacebase register for a given address space.
The spacebase register is looked up for the given address space. An insertion point op must be provided, and newly generated ops can come either before or after this insertion point. The Varnode value being stored must still be set on the returned PcodeOp.
| spc | is the given address space |
| off | is the offset to calculate relative to the spacebase register |
| op | is the insertion point PcodeOp |
| insertafter | is true if new ops are inserted after the insertion point |
References CPUI_STORE, createStackRef(), PcodeOp::getAddr(), AddrSpace::getContain(), Varnode::getDef(), newOp(), newVarnodeSpace(), opInsertAfter(), opSetInput(), and opSetOpcode().
Referenced by target().
| void Funcdata::opSwapInput | ( | PcodeOp * | op, |
| int4 | slot1, | ||
| int4 | slot2 | ||
| ) |
Swap two input operands in the given PcodeOp.
This is convenience method that is more efficient than call opSetInput() twice.
| op | is the given PcodeOp |
| slot1 | is the first input slot being switched |
| slot2 | is the second input slot |
References PcodeOp::getIn(), and PcodeOp::setInput().
Referenced by ActionConstantPtr::apply(), RuleTermOrder::applyOp(), RuleBoolNegate::applyOp(), opFlipInPlaceExecute(), and opHeritage().
| void Funcdata::opUndoPtradd | ( | PcodeOp * | op, |
| bool | finalize | ||
| ) |
Convert a CPUI_PTRADD back into a CPUI_INT_ADD.
Convert the given CPUI_PTRADD into the equivalent CPUI_INT_ADD. This may involve inserting a CPUI_INT_MULT PcodeOp. If finalization is requested and a new PcodeOp is needed, the output Varnode is marked as implicit and has its data-type set
| op | is the given PTRADD |
| finalize | is true if finalization is needed for any new PcodeOp |
References calc_mask(), CPUI_INT_ADD, CPUI_INT_MULT, PcodeOp::getAddr(), PcodeOp::getIn(), Varnode::getOffset(), Varnode::getSize(), Varnode::getType(), Varnode::isConstant(), newConstant(), newOp(), newUniqueOut(), opInsertBefore(), opRemoveInput(), opSetInput(), opSetOpcode(), Varnode::setImplied(), and Varnode::updateType().
Referenced by ActionSetCasts::apply(), RulePtraddUndo::applyOp(), and target().
| void Funcdata::opUninsert | ( | PcodeOp * | op | ) |
Remove the given PcodeOp from its basic block.
The op is taken out of its basic block and put into the dead list. If the removal is permanent the input and output Varnodes should be unset.
| op | is the given PcodeOp |
References PcodeOp::getParent(), PcodeOpBank::markDead(), obank, and BlockBasic::removeOp().
Referenced by RulePushMulti::applyOp(), RuleMultiCollapse::applyOp(), RuleConditionalMove::applyOp(), FuncCallSpecs::commitNewOutputs(), opHeritage(), and opUnlink().
| void Funcdata::opUnlink | ( | PcodeOp * | op | ) |
Unset inputs/output and remove given PcodeOP from its basic block.
The op is extricated from all its Varnode connections to the functions data-flow and removed from its basic block. This will not change block connections. The PcodeOp objects remains in the dead list.
| op | is the given PcodeOp |
References PcodeOp::getParent(), PcodeOp::numInput(), opUninsert(), opUnsetInput(), and opUnsetOutput().
Referenced by RuleSubRight::applyOp(), FuncCallSpecs::commitNewOutputs(), and opHeritage().
| void Funcdata::opUnsetInput | ( | PcodeOp * | op, |
| int4 | slot | ||
| ) |
Clear an input operand slot for the given PcodeOp.
The input Varnode is unlinked from the op.
| op | is the given PcodeOp |
| slot | is the input slot to clear |
References PcodeOp::clearInput(), Varnode::eraseDescend(), and PcodeOp::getIn().
Referenced by RuleLeftRight::applyOp(), TransformOp::createReplacement(), opDestroy(), opHeritage(), opRemoveInput(), opSetAllInput(), opSetInput(), and opUnlink().
| void Funcdata::opUnsetOutput | ( | PcodeOp * | op | ) |
Remove output Varnode from the given PcodeOp.
The output Varnode becomes free but is not immediately deleted.
| op | is the given PcodeOp |
References Varnode::clearCover(), PcodeOp::getOut(), VarnodeBank::makeFree(), PcodeOp::setOutput(), and vbank.
Referenced by ActionDeadCode::apply(), RuleLeftRight::applyOp(), RuleSubCommute::cancelExtensions(), FuncCallSpecs::commitNewOutputs(), ActionDeadCode::neverConsumed(), opHeritage(), opSetOutput(), and opUnlink().
|
private |
Transform trivial CPUI_MULTIEQUAL to CPUI_COPY.
If the MULTIEQUAL has no inputs, presumably the basic block is unreachable, so we treat the p-code op as a COPY from a new input Varnode. If there is 1 input, the MULTIEQUAL is transformed directly into a COPY.
| op | is the given MULTIEQUAL |
References CPUI_COPY, Varnode::getAddr(), PcodeOp::getIn(), PcodeOp::getOut(), Varnode::getSize(), newVarnode(), PcodeOp::numInput(), opInsertInput(), opSetOpcode(), and setInputVarnode().
Referenced by blockRemoveInternal(), and branchRemoveInternal().
| void Funcdata::overrideFlow | ( | const Address & | addr, |
| uint4 | type | ||
| ) |
Override the control-flow p-code for a particular instruction.
P-code in this function is modified to change the control-flow of the instruction at the given address, based on the Override type.
| addr | is the given address of the instruction to modify |
| type | is the Override type |
References beginOp(), Override::BRANCH, Override::CALL, Override::CALL_RETURN, PcodeOp::code(), CPUI_BRANCH, CPUI_BRANCHIND, CPUI_CALL, CPUI_CALLIND, CPUI_CBRANCH, CPUI_RETURN, endOp(), findPrimaryBranch(), PcodeOp::isDead(), newConstant(), newOp(), opDeadInsertAfter(), opSetInput(), opSetOpcode(), and Override::RETURN.
Referenced by getCleanUpIndex(), and FlowInfo::processInstruction().
| void Funcdata::printBlockTree | ( | ostream & | s | ) | const |
Print a description of control-flow structuring to a stream.
A description of each block in the current structure hierarchy is printed to stream. This is suitable for a console mode or debug view of the state of control-flow structuring at any point during analysis.
| s | is the output stream |
References BlockGraph::getSize(), BlockGraph::printTree(), and sblocks.
Referenced by getCleanUpIndex().
| void Funcdata::printLocalRange | ( | ostream & | s | ) | const |
Print description of memory ranges associated with local scopes.
Each scope has a set of memory ranges associated with it, encompassing storage locations of variables that are assumed to be in the scope. Each range for each local scope is printed.
| s | is the output stream |
References Scope::childrenBegin(), Scope::childrenEnd(), localmap, and Scope::printBounds().
Referenced by getCleanUpIndex().
| void Funcdata::printRaw | ( | ostream & | s | ) | const |
Print raw p-code op descriptions to a stream.
A representation of all PcodeOps in the function body are printed to the stream. Depending on the state of analysis, PcodeOps are grouped into their basic blocks, and within a block, ops are displayed sequentially. Basic labeling of branch destinations is also printed. This is suitable for a console mode or debug view of the state of the function at any given point in its analysis.
| s | is the output stream |
References bblocks, PcodeOpBank::beginAll(), PcodeOpBank::empty(), PcodeOpBank::endAll(), BlockGraph::getSize(), obank, and BlockGraph::printRaw().
Referenced by Varnode::clearConsumeVacuous(), getCleanUpIndex(), DecompileAt::rawAction(), and BlockBasic::subBlock().
| void Funcdata::printVarnodeTree | ( | ostream & | s | ) | const |
Print a description of all Varnodes to a stream.
A description of each Varnode currently involved in the data-flow of this function is printed to the output stream. This is suitable as part of a console mode or debug view of the function at any point during its analysis
| s | is the output stream |
References VarnodeBank::beginDef(), VarnodeBank::endDef(), Varnode::printInfo(), and vbank.
Referenced by getCleanUpIndex().
| void Funcdata::pushBranch | ( | BlockBasic * | bb, |
| int4 | slot, | ||
| BlockBasic * | bbnew | ||
| ) |
Move a control-flow edge from one block to another.
This is intended for eliminating switch guard artifacts. The edge must be for a conditional jump and must be moved to a block hosting multiple out edges for a BRANCHIND.
| bb | is the basic block out of which the edge to move flows |
| slot | is the index of the (out) edge |
| bbnew | is the basic block where the edge should get moved to |
References bblocks, PcodeOp::code(), CPUI_BRANCH, CPUI_BRANCHIND, CPUI_CBRANCH, BlockBasic::lastOp(), BlockGraph::moveOutEdge(), opRemoveInput(), opSetOpcode(), FlowBlock::sizeOut(), and structureReset().
Referenced by JumpBasic::foldInOneGuard(), and setBasicBlockRange().
|
private |
Push MULTIEQUAL Varnodes of the given block into the output block.
Assuming the given basic block is being removed, force any Varnode defined by a MULTIEQUAL in the block to be defined in the output block instead. This is used as part of the basic block removal process to patch up data-flow.
| bb | is the given basic block |
References Varnode::beginDescend(), BlockBasic::beginOp(), PcodeOp::code(), CPUI_MULTIEQUAL, Varnode::descend, Varnode::endDescend(), BlockBasic::endOp(), Varnode::getAddr(), PcodeOp::getIn(), FlowBlock::getIn(), PcodeOp::getOut(), FlowBlock::getOut(), FlowBlock::getOutRevIndex(), PcodeOp::getParent(), Varnode::getSize(), PcodeOp::getSlot(), BlockBasic::getStart(), Varnode::hasNoDescend(), Varnode::isAddrTied(), newOp(), newUnique(), newVarnode(), PcodeOp::numInput(), opInsertBegin(), opSetAllInput(), opSetInput(), opSetOpcode(), opSetOutput(), FlowBlock::sizeIn(), FlowBlock::sizeOut(), and warningHeader().
Referenced by blockRemoveInternal().
Recover destinations for a BRANCHIND by analyzing nearby data and control-flow.
This is the high-level entry point for jump-table/switch recovery. In short, a copy of the current state of data-flow is made, simplification transformations are applied to the copy, and the resulting data-flow tree is examined to enumerate possible values of the input Varnode to the given BRANCHIND PcodeOp. This information is stored in a JumpTable object.
| op | is the given BRANCHIND PcodeOp |
| flow | is current flow information for this function |
| failuremode | will hold the final success/failure code (0=success) |
References flags, JumpTable::getStage(), glb, JumpTable::isOverride(), jumptablerecovery_dont, jumpvec, linkJumpTable(), JumpTable::setIndirectOp(), and stageJumpTable().
Referenced by endOp(), and FlowInfo::generateOps().
| void Funcdata::remapDynamicVarnode | ( | Varnode * | vn, |
| Symbol * | sym, | ||
| const Address & | usepoint, | ||
| uint8 | hash | ||
| ) |
Remap a Symbol to a given Varnode using a new dynamic mapping.
Any previous links between the Symbol, the Varnode, and the associate HighVariable are removed. Then a new dynamic link is created.
| vn | is the given Varnode |
| sym | is the Symbol the Varnode maps to |
| usepoint | is the code Address where the Varnode is defined |
| hash | is the hash for the new dynamic mapping |
References clearSymbolLinks(), Varnode::getHigh(), localmap, ScopeLocal::remapSymbolDynamic(), and Varnode::setSymbolEntry().
Referenced by clearDeadOps().
Remap a Symbol to a given Varnode using a static mapping.
Any previous links between the Symbol, the Varnode, and the associate HighVariable are removed. Then a new link is created.
| vn | is the given Varnode |
| sym | is the Symbol the Varnode maps to |
| usepoint | is the desired usepoint for the mapping |
References clearSymbolLinks(), Varnode::getAddr(), Varnode::getHigh(), localmap, ScopeLocal::remapSymbol(), and Varnode::setSymbolEntry().
Referenced by clearDeadOps().
| void Funcdata::removeBranch | ( | BlockBasic * | bb, |
| int4 | num | ||
| ) |
Remove the indicated branch from a basic block.
The edge is removed from control-flow and affected MULTIEQUAL ops are adjusted.
| bb | is the basic block |
| num | is the index of the out edge to remove |
References branchRemoveInternal(), and structureReset().
Referenced by ActionRedundBranch::apply(), ActionDeterminedBranch::apply(), and setBasicBlockRange().
| void Funcdata::removeDoNothingBlock | ( | BlockBasic * | bb | ) |
Remove a basic block from control-flow that performs no operations.
The block must contain only marker operations (MULTIEQUAL) and possibly a single unconditional branch operation. The block and its PcodeOps are completely removed from the current control-flow and data-flow. This forces a reset of the control-flow structuring hierarchy.
| bb | is the given basic block |
References blockRemoveInternal(), FlowBlock::setDead(), FlowBlock::sizeOut(), and structureReset().
Referenced by ActionDoNothing::apply(), and setBasicBlockRange().
| void Funcdata::removeFromFlowSplit | ( | BlockBasic * | bl, |
| bool | swap | ||
| ) |
Remove a basic block splitting its control-flow into two distinct paths.
This is used by ConditionalExecution to eliminate unnecessary control-flow joins. The given block must have 2 inputs and 2 outputs, (and no operations). The block is removed, and control-flow is adjusted so that In(0) flows to Out(0) and In(1) flows to Out(1), or vice versa.
| bl | is the given basic block |
| swap | is true to force In(0)->Out(1) and In(1)->Out(0) |
References bblocks, BlockBasic::emptyOp(), BlockGraph::removeBlock(), BlockGraph::removeFromFlowSplit(), and structureReset().
Referenced by setBasicBlockRange().
| void Funcdata::removeJumpTable | ( | JumpTable * | jt | ) |
Remove/delete the given jump-table.
The JumpTable object is freed, and the associated BRANCHIND is no longer marked as a switch point.
| jt | is the given JumpTable object |
References FlowBlock::clearFlag(), FlowBlock::f_switch_out, JumpTable::getIndirectOp(), PcodeOp::getParent(), and jumpvec.
Referenced by RuleSwitchSingle::applyOp(), blockRemoveInternal(), and getJumpTable().
| bool Funcdata::removeUnreachableBlocks | ( | bool | issuewarning, |
| bool | checkexistence | ||
| ) |
Remove any unreachable basic blocks.
A quick check for unreachable blocks can optionally be made, otherwise the cached state is checked via hasUnreachableBlocks(), which is turned on during analysis by calling the structureReset() method.
| issuewarning | is true if warning comments are desired |
| checkexistence | is true to force an active search for unreachable blocks |
References bblocks, blockRemoveInternal(), branchRemoveInternal(), BlockGraph::collectReachable(), BlockGraph::getBlock(), FlowBlock::getImmedDom(), AddrSpace::getName(), BlockGraph::getSize(), Address::getSpace(), BlockBasic::getStart(), hasUnreachableBlocks(), FlowBlock::isEntryPoint(), Address::printRaw(), FlowBlock::sizeOut(), structureReset(), and warningHeader().
Referenced by ActionUnreachable::apply(), FlowInfo::generateBlocks(), and setBasicBlockRange().
| bool Funcdata::replaceLessequal | ( | PcodeOp * | op | ) |
Replace INT_LESSEQUAL and INT_SLESSEQUAL expressions.
Do in-place replacement of
c <= x with c-1 < x ORx <= c with x < c+1| op | is comparison PcodeOp |
References calc_mask(), PcodeOp::code(), Varnode::copySymbol(), CPUI_INT_LESS, CPUI_INT_SLESS, CPUI_INT_SLESSEQUAL, PcodeOp::getIn(), Varnode::getOffset(), Varnode::getSize(), newConstant(), opSetInput(), opSetOpcode(), and sign_extend().
Referenced by RuleIntLessEqual::applyOp(), opFlipInPlaceExecute(), and setBasicBlockRange().
| bool Funcdata::replaceVolatile | ( | Varnode * | vn | ) |
Replace accesses of the given Varnode with volatile operations.
The Varnode is assumed not fully linked. The read or write action is modeled by inserting a special user op that represents the action. The given Varnode is replaced by a temporary Varnode within the data-flow, and the original address becomes a parameter to the user op.
| vn | is the given Varnode to model as volatile |
References CPUI_CALLOTHER, PcodeOp::getAddr(), Varnode::getAddr(), Varnode::getDef(), UserPcodeOp::getIndex(), Varnode::getSize(), PcodeOp::getSlot(), UserOpManage::getVolatileRead(), UserOpManage::getVolatileWrite(), glb, Varnode::hasNoDescend(), Varnode::isTypeLock(), Varnode::isWritten(), Varnode::loneDescend(), newCodeRef(), newConstant(), newOp(), newUnique(), newUniqueOut(), opInsertAfter(), opInsertBefore(), opSetInput(), opSetOpcode(), opSetOutput(), PcodeOp::setAdditionalFlag(), PcodeOp::special_prop, and Architecture::userops.
Referenced by ActionVarnodeProps::apply(), and clearLanedAccessMap().
| uint8 Funcdata::restoreXml | ( | const Element * | el | ) |
Restore the state of this function from an XML description.
From an XML <function> tag, recover the name, address, prototype, symbol, jump-table, and override information for this function.
| el | is the root <function> tag |
References Database::attachScope(), baseaddr, flags, funcp, Element::getAttributeName(), Element::getAttributeValue(), Element::getChildren(), Database::getGlobalScope(), Element::getNumAttributes(), AddrSpaceManager::getStackSpace(), glb, localmap, localoverride, name, no_code, ScopeLocal::resetLocalWindow(), Override::restoreXml(), Address::restoreXml(), FuncProto::restoreXml(), restoreXmlJumpTable(), Database::restoreXmlScope(), FuncProto::setScope(), size, Architecture::symboltab, and xml_readbool().
Referenced by getCleanUpIndex(), and FunctionSymbol::restoreXml().
| void Funcdata::restoreXmlJumpTable | ( | const Element * | el | ) |
Restore jump-tables from an XML description.
This parses a <jumptablelist> tag and builds a JumpTable object for each <jumptable> sub-tag.
| el | is the root <jumptablelist> tag |
References Element::getChildren(), glb, jumpvec, and JumpTable::restoreXml().
Referenced by getCleanUpIndex(), and restoreXml().
|
staticprivate |
Save XML descriptions for a set of Varnodes to stream.
This is an internal function for the function's save to XML system. Individual XML tags are written in sequence for Varnodes in a given set. The set is bounded by iterators using the 'loc' ordering.
| s | is the output stream |
| iter | is the beginning of the set |
| enditer | is the end of the set |
References Varnode::saveXml().
Referenced by saveXmlTree().
| void Funcdata::saveXml | ( | ostream & | s, |
| uint8 | id, | ||
| bool | savetree | ||
| ) | const |
Emit an XML description of this function to stream.
An XML description of this function is written to the stream, including name, address, prototype, symbol, jump-table, and override information. If indicated by the caller, a description of the entire PcodeOp and Varnode tree is also emitted.
| s | is the output stream |
| id | is the unique id associated with the function symbol |
| savetree | is true if the p-code tree should be emitted |
References a_v(), a_v_b(), a_v_i(), a_v_u(), baseaddr, funcp, glb, hasNoCode(), localmap, localoverride, name, Override::saveXml(), Address::saveXml(), FuncProto::saveXml(), saveXmlHigh(), saveXmlJumpTable(), Scope::saveXmlRecursive(), saveXmlTree(), and size.
Referenced by getCleanUpIndex(), DecompileAt::rawAction(), FunctionSymbol::saveXml(), and Varnode::setLockedInput().
| void Funcdata::saveXmlHigh | ( | ostream & | s | ) | const |
Save an XML description of all HighVariables to stream.
This produces a single <highlist> tag, with a <high> sub-tag for each high-level variable (HighVariable) currently associated with this function.
| s | is the output stream |
References beginLoc(), HighVariable::clearMark(), endLoc(), Varnode::getHigh(), Varnode::isAnnotation(), isHighOn(), HighVariable::isMark(), HighVariable::saveXml(), and HighVariable::setMark().
Referenced by getCleanUpIndex(), and saveXml().
| void Funcdata::saveXmlJumpTable | ( | ostream & | s | ) | const |
Emit an XML description of jump-tables to stream.
A <jumptablelist> tag is written with <jumptable> sub-tags describing each jump-table associated with the control-flow of this function.
| s | is the output stream |
References jumpvec.
Referenced by getCleanUpIndex(), and saveXml().
| void Funcdata::saveXmlTree | ( | ostream & | s | ) | const |
Save an XML description of the p-code tree to stream.
A single <ast> tag is produced with children describing Varnodes, PcodeOps, and basic blocks making up this function's current syntax tree.
| s | is the output stream |
References a_v_i(), bblocks, VarnodeBank::beginLoc(), BlockBasic::beginOp(), VarnodeBank::endLoc(), BlockBasic::endOp(), BlockGraph::getBlock(), FlowBlock::getIndex(), BlockGraph::getSize(), AddrSpaceManager::getSpace(), AddrSpace::getType(), glb, IPTR_IOP, AddrSpaceManager::numSpaces(), saveVarnodeXml(), PcodeOp::saveXml(), BlockBasic::saveXmlBody(), FlowBlock::saveXmlEdges(), FlowBlock::sizeIn(), and vbank.
Referenced by getCleanUpIndex(), and saveXml().
|
inline |
Mark that dead Varnodes have been seen in a specific address space.
| spc | is the address space to mark |
References Heritage::seenDeadCode().
Referenced by ActionDeadCode::apply().
|
inline |
Set the initial ownership range for the given basic block.
| bb | is the given basic block |
| beg | is the beginning Address of the owned code range |
| end | is the ending Address of the owned code range |
References collapseIntMultMult(), compareCallspecs(), distributeIntMultAdd(), forceGoto(), installSwitchDefaults(), nodeJoinCreateBlock(), nodeSplit(), pushBranch(), removeBranch(), removeDoNothingBlock(), removeFromFlowSplit(), removeUnreachableBlocks(), replaceLessequal(), BlockBasic::setInitialRange(), spliceBlockBasic(), and switchEdge().
Referenced by FlowInfo::generateBlocks(), and FlowInfo::splitBasic().
|
inline |
Set a delay before removing dead code for a specific address space.
| spc | is the specific address space |
| delay | is the number of passes to delay |
References Heritage::setDeadCodeDelay().
Referenced by Override::applyDeadCodeDelay().
|
inline |
Toggle whether double precision analysis is used.
| val | is true if double precision analysis is enabled |
References double_precis_on.
Referenced by RuleDoubleIn::reset().
Mark a Varnode as an input to the function.
An input Varnode has a special designation within SSA form as not being defined by a p-code operation and is a formal input to the data-flow of the function. It is not necessarily a formal function parameter.
The given Varnode to be marked is also returned unless there is an input Varnode that already exists which overlaps the given Varnode. If the Varnodes have the same size and storage address, the preexisting input Varnode is returned instead. Otherwise an exception is thrown.
| vn | is the given Varnode to mark as an input |
References VarnodeBank::beginDef(), funcp, Varnode::getAddr(), Varnode::getSize(), FuncProto::hasEffect(), Varnode::input, Varnode::isInput(), Varnode::overlap(), EffectRecord::return_address, VarnodeBank::setInput(), Varnode::setReturnAddress(), Varnode::setUnaffected(), setVarnodeProperties(), EffectRecord::unaffected, and vbank.
Referenced by adjustInputVarnodes(), ActionPrototypeTypes::apply(), ActionInputPrototype::apply(), SubvariableFlow::getReplaceVarnode(), numVarnodes(), opZeroMulti(), SubvariableFlow::replaceInput(), and TransformManager::transformInputVarnodes().
|
inline |
Toggle whether this is being used for jump-table recovery.
| val | is true to indicate a jump-table is being recovered |
References jumptablerecovery_dont.
|
inline |
Toggle whether analysis needs to be restarted for this function.
| val | is true if a reset is required |
References restart_pending.
Referenced by ActionSwitchNorm::apply(), FuncCallSpecs::deindirect(), and FuncCallSpecs::forceSet().
|
private |
Look-up boolean properties and data-type information.
Properties of a given storage location are gathered from symbol information and applied to the given Varnode.
| vn | is the given Varnode |
References Varnode::calcCover(), Varnode::cover, Varnode::getAddr(), Varnode::getSize(), Varnode::getUsePoint(), isHighOn(), Varnode::isMapped(), localmap, Scope::queryProperties(), Varnode::setFlags(), Varnode::setSymbolProperties(), and Varnode::typelock.
Referenced by opSetOutput(), and setInputVarnode().
|
private |
Sort calls using a dominance based order.
Calls are put in dominance order so that earlier calls get evaluated first. Order affects parameter analysis.
References compareCallspecs(), and qlst.
Referenced by startProcessing().
| void Funcdata::spacebase | ( | void | ) |
Mark registers that map to a virtual address space.
This routine searches for an marks Varnode objects, like stack-pointer registers, that are used as a base address for a virtual address space. Each Varnode gets a special data-type and is marked so that Varnode::isSpacebase() returns true.
References VarnodeBank::beginLoc(), PcodeOp::code(), CPUI_INT_ADD, VarnodeBank::endLoc(), getAddress(), Varnode::getDef(), AddrSpaceManager::getSpace(), AddrSpace::getSpacebase(), TypeFactory::getTypePointer(), TypeFactory::getTypeSpacebase(), AddrSpace::getWordSize(), glb, Varnode::isFree(), Varnode::isInput(), Varnode::isSpacebase(), AddrSpace::numSpacebase(), AddrSpaceManager::numSpaces(), Varnode::setFlags(), Varnode::spacebase, splitUses(), Architecture::types, Varnode::updateType(), and vbank.
Referenced by ActionSpacebase::apply(), and hasBadData().
| void Funcdata::spacebaseConstant | ( | PcodeOp * | op, |
| int4 | slot, | ||
| SymbolEntry * | entry, | ||
| const Address & | rampoint, | ||
| uintb | origval, | ||
| int4 | origsize | ||
| ) |
Convert a constant pointer into a ram CPUI_PTRSUB.
A constant known to be a pointer into an address space like ram is converted into a Varnode defined by CPUI_PTRSUB, which triggers a Symbol lookup at points during analysis. The constant must point to a known Symbol.
The PTRSUB takes the constant 0 as its first input, which is marked as a spacebase to indicate this situation. The second input to PTRSUB becomes the offset to the Symbol within the address space. An additional INT_SUB may be inserted to get from the start of the Symbol to the address indicated by the original constant pointer.
| op | is the PcodeOp referencing the constant pointer |
| slot | is the input slot of the constant pointer |
| entry | is the Symbol being pointed (in)to |
| rampoint | is the constant pointer interpreted as an Address |
| origval | is the constant |
| origsize | is the size of the constant |
References AddrSpace::byteToAddress(), PcodeOp::code(), CPUI_COPY, CPUI_INT_ADD, CPUI_INT_ZEXT, CPUI_PTRSUB, CPUI_SUBPIECE, SymbolEntry::getAddr(), PcodeOp::getAddr(), Address::getAddrSize(), Datatype::getMetatype(), Address::getOffset(), PcodeOp::getOut(), Address::getSpace(), SymbolEntry::getSymbol(), Symbol::getType(), TypeFactory::getTypePointer(), TypeFactory::getTypePointerStripArray(), TypeFactory::getTypeSpacebase(), AddrSpace::getWordSize(), glb, PcodeOp::insertInput(), AddrSpace::isTruncated(), Symbol::isTypeLocked(), newConstant(), newOp(), newUniqueOut(), opInsertBefore(), opSetInput(), opSetOpcode(), Varnode::setFlags(), Varnode::setPtrCheck(), Varnode::spacebase, TYPE_UNKNOWN, Architecture::types, and Varnode::updateType().
Referenced by ActionConstantPtr::apply(), and hasBadData().
| void Funcdata::spliceBlockBasic | ( | BlockBasic * | bl | ) |
Merge the given basic block with the block it flows into.
The given block must have a single output block, which will be removed. The given block has the p-code from the output block concatenated to its own, and it inherits the output block's out edges.
| bl | is the given basic block |
References bblocks, BlockBasic::beginOp(), PcodeOp::clearFlag(), PcodeOp::code(), CPUI_MULTIEQUAL, BlockBasic::endOp(), FlowBlock::getOut(), PcodeOp::isBranch(), BlockBasic::mergeRange(), BlockBasic::op, opDestroy(), BlockBasic::setOrder(), PcodeOp::setParent(), FlowBlock::sizeIn(), FlowBlock::sizeOut(), BlockGraph::spliceBlock(), PcodeOp::startbasic, and structureReset().
Referenced by ActionRedundBranch::apply(), and setBasicBlockRange().
|
private |
Make all reads of the given Varnode unique.
For the given Varnode, duplicate its defining PcodeOp at each read of the Varnode so that the read becomes a new unique Varnode. This operation should not be performed on any PcodeOp with side effects like CPUI_CALL.
| vn | is the given Varnode |
References PcodeOp::code(), Varnode::descend, PcodeOp::getAddr(), Varnode::getAddr(), Varnode::getDef(), PcodeOp::getIn(), Varnode::getSize(), PcodeOp::getSlot(), Varnode::getType(), newOp(), newVarnode(), PcodeOp::numInput(), opInsertBefore(), opSetInput(), opSetOpcode(), and opSetOutput().
Referenced by spacebase().
Recover a jump-table for a given BRANCHIND using existing flow information.
A partial function (copy) is built using the flow info. Simplification is performed on the partial function (using the "jumptable" strategy), then destination addresses of the branch are recovered by examining the simplified data-flow. The jump-table object is populated with the recovered addresses. An integer value is returned:
| jt | is the jump-table object to populate |
| op | is the BRANCHIND p-code op to analyze |
| flow | is the existing flow information |
References Architecture::allacts, baseaddr, PcodeOp::code(), CPUI_BRANCHIND, FlowInfo::doesJumpRecord(), LowlevelError::explain, findOp(), flags, PcodeOp::getAddr(), ActionDatabase::getCurrent(), ActionDatabase::getCurrentName(), Scope::getParent(), PcodeOp::getSeqNum(), JumpTable::getStage(), glb, PcodeOp::isDead(), jumptablerecovery_on, localmap, name, Action::perform(), Address::printRaw(), JumpTable::recoverAddresses(), JumpTable::recoverMultistage(), Action::reset(), ActionDatabase::setCurrent(), JumpTable::setIndirectOp(), JumpTable::setLoadCollect(), truncatedFlow(), and warning().
Referenced by recoverJumpTable().
| void Funcdata::startProcessing | ( | void | ) |
Start processing for this function.
This routine does basic set-up for analyzing the function. In particular, it generates the raw p-code, builds basic blocks, and generates the call specification objects.
References Override::applyDeadCodeDelay(), baseaddr, Heritage::buildInfoList(), flags, followFlow(), funcp, Address::getSpace(), heritage, FuncProto::isInline(), localoverride, processing_started, sortCallSpecs(), structureReset(), and warningHeader().
Referenced by ActionStart::apply(), and hasNoStructBlocks().
|
private |
Calculate initial basic block structures (after a control-flow change)
For the current control-flow graph, (re)calculate the loop structure and dominance. This can be called multiple times as changes are made to control-flow. The structured hierarchy is also reset.
References bblocks, blocks_unreachable, BlockGraph::calcForwardDominator(), BlockGraph::clear(), flags, Heritage::forceRestructure(), JumpTable::getIndirectOp(), heritage, PcodeOp::isDead(), jumpvec, sblocks, BlockGraph::structureLoops(), and warningHeader().
Referenced by nodeJoinCreateBlock(), nodeSplit(), pushBranch(), removeBranch(), removeDoNothingBlock(), removeFromFlowSplit(), removeUnreachableBlocks(), spliceBlockBasic(), startProcessing(), and switchEdge().
| void Funcdata::switchEdge | ( | FlowBlock * | inblock, |
| BlockBasic * | outbefore, | ||
| FlowBlock * | outafter | ||
| ) |
Switch an outgoing edge from the given source block to flow into another block.
This does not adjust MULTIEQUAL data-flow.
| inblock | is the given source block |
| outbefore | is the other side of the desired edge |
| outafter | is the new destination block desired |
References bblocks, structureReset(), and BlockGraph::switchEdge().
Referenced by setBasicBlockRange().
|
private |
Convert jump-table addresses to basic block indices.
For each jump-table, for each address, the corresponding basic block index is computed. This also calculates the default branch for each jump-table.
| flow | is the flow object (mapping addresses to p-code ops) |
References jumpvec.
Referenced by followFlow().
|
private |
Update properties (and the data-type) for a set of Varnodes associated with one Symbol.
The set of Varnodes with the same size and address all have their boolean properties updated to the given values. The set is specified by providing an iterator reference to the first Varnode in the set assuming a 'loc' ordering. This iterator is updated to point to the first Varnode after the affected set.
The only properties that can be effectively changed with this routine are mapped, addrtied, addrforce, and nolocalalias. HighVariable splits must occur if addrtied is cleared.
If the given data-type is non-null, an attempt is made to update all the Varnodes to this data-type. The typelock and namelock properties cannot be changed here.
| iter | points to the first Varnode in the set |
| flags | holds the new set of boolean properties |
| ct | is the given data-type to set (or NULL) |
References Varnode::addrforce, Varnode::addrtied, Varnode::clearFlags(), VarnodeBank::endLoc(), HighVariable::finalizeDatatype(), Varnode::getAddr(), Varnode::getFlags(), Varnode::getHigh(), Varnode::getSize(), Varnode::isFree(), Varnode::mapentry, Varnode::mapped, Varnode::nolocalalias, Varnode::setFlags(), Varnode::updateType(), and vbank.
Referenced by syncVarnodesWithSymbols().
| bool Funcdata::syncVarnodesWithSymbols | ( | const ScopeLocal * | lm, |
| bool | typesyes | ||
| ) |
Update Varnode properties based on (new) Symbol information.
Boolean properties addrtied, addrforce, and nolocalalias for Varnodes are updated based on new Symbol information they map to. The caller can elect to update data-type information as well, where Varnodes and their associated HighVariables have their data-type finalized based symbols.
| lm | is the Symbol scope within which to search for mapped Varnodes |
| typesyes | is true if the caller wants to update data-types |
References Varnode::addrtied, VarnodeBank::beginLoc(), VarnodeBank::endLoc(), ScopeInternal::findOverlap(), flags, SymbolEntry::getAddr(), Varnode::getAddr(), SymbolEntry::getAllFlags(), Datatype::getMetatype(), Address::getOffset(), SymbolEntry::getOffset(), Varnode::getOffset(), Datatype::getSize(), SymbolEntry::getSize(), Varnode::getSize(), ScopeLocal::getSpaceId(), Datatype::getSubType(), SymbolEntry::getSymbol(), Symbol::getType(), Varnode::getUsePoint(), Scope::inScope(), Varnode::mapped, Varnode::namelock, syncVarnodesWithSymbol(), TYPE_UNKNOWN, Varnode::typelock, and vbank.
Referenced by ActionRestructureVarnode::apply(), ActionRestructureHigh::apply(), and clearLanedAccessMap().
Replace all read references to the first Varnode with a second Varnode.
References Varnode::beginDescend(), Varnode::endDescend(), PcodeOp::getSlot(), and opSetInput().
Referenced by adjustInputVarnodes(), RulePushMulti::applyOp(), RuleIndirectCollapse::applyOp(), RuleMultiCollapse::applyOp(), clearLanedAccessMap(), cseElimination(), ActionMultiCse::processBlock(), and SubvariableFlow::replaceInput().
| void Funcdata::totalReplaceConstant | ( | Varnode * | vn, |
| uintb | val | ||
| ) |
Replace every read reference of the given Varnode with a constant value.
A new constant Varnode is created for each read site. If there are any marker ops (MULTIEQUAL) a single COPY op is inserted and the marker input is set to be the output of the COPY.
| vn | is the given Varnode |
| val | is the constant value to replace it with |
References Varnode::beginDescend(), CPUI_COPY, Varnode::endDescend(), PcodeOp::getAddr(), getBasicBlocks(), BlockGraph::getBlock(), Varnode::getDef(), PcodeOp::getOut(), Varnode::getSize(), PcodeOp::getSlot(), BlockBasic::getStart(), PcodeOp::isMarker(), Varnode::isWritten(), newConstant(), newOp(), newUniqueOut(), opInsertAfter(), opInsertBegin(), opSetInput(), and opSetOpcode().
Referenced by ActionVarnodeProps::apply(), and clearLanedAccessMap().
Copy properties from an existing Varnode to a new Varnode.
The new Varnode is assumed to overlap the storage of the existing Varnode. Properties like boolean flags and consume bits are copied as appropriate.
| vn | is the existing Varnode |
| newVn | is the new Varnode that has its properties set |
| lsbOffset | is the significance offset of the new Varnode within the exising |
References Varnode::addrforce, calc_mask(), Varnode::directwrite, Varnode::getConsume(), Varnode::getFlags(), Varnode::getSize(), Varnode::setConsume(), and Varnode::setFlags().
Referenced by clearLanedAccessMap(), and TransformVar::createReplacement().
Generate a clone with truncated control-flow given a partial function.
Existing p-code is cloned from another function whose flow has not been completely followed. Artificial halt operators are inserted wherever flow is incomplete and basic blocks are generated.
| fd | is the partial function to clone |
| flow | is partial function's flow information |
References bblocks, PcodeOpBank::beginDead(), blocks_generated, FlowInfo::clearFlags(), FuncCallSpecs::clone(), cloneOp(), deleteVarnode(), PcodeOpBank::empty(), PcodeOpBank::endDead(), findOp(), flags, FlowInfo::generateBlocks(), PcodeOp::getIn(), FuncCallSpecs::getOp(), PcodeOp::getSeqNum(), Varnode::getSpace(), AddrSpace::getType(), PcodeOpBank::getUniqId(), FlowInfo::hasInject(), FlowInfo::injectPcode(), IPTR_FSPEC, jumpvec, newVarnodeCallSpecs(), obank, opSetInput(), FlowInfo::possible_unreachable, qlst, JumpTable::setIndirectOp(), and PcodeOpBank::setUniqId().
Referenced by getCleanUpIndex(), and stageJumpTable().
| void Funcdata::warning | ( | const string & | txt, |
| const Address & | ad | ||
| ) | const |
Add a warning comment in the function body.
The comment is added to the global database, indexed via its placement address and the entry address of the function. The emitter will attempt to place the comment before the source expression that maps most closely to the address.
| txt | is the string body of the comment |
| ad | is the placement address |
References CommentDatabase::addCommentNoDuplicate(), baseaddr, Architecture::commentdb, flags, glb, jumptablerecovery_on, and Comment::warning.
Referenced by ActionSetCasts::apply(), ActionDoNothing::apply(), ActionPrototypeWarnings::apply(), RuleIndirectCollapse::applyOp(), JumpBasic::buildLabels(), JumpBasicOverride::buildLabels(), AddTreeState::buildTree(), FlowInfo::checkContainedCall(), FlowInfo::checkForFlowModification(), fillinReadOnly(), FlowInfo::handleOutOfBounds(), hasNoStructBlocks(), FlowInfo::processInstruction(), JumpTable::recoverLabels(), JumpTable::recoverMultistage(), JumpTable::sanityCheck(), stageJumpTable(), FlowInfo::testHardInlineRestrictions(), and FlowInfo::truncateIndirectJump().
| void Funcdata::warningHeader | ( | const string & | txt | ) | const |
Add a warning comment as part of the function header.
The warning will be emitted as part of the block comment printed right before the prototype. The comment is stored in the global comment database, indexed via the function's entry address.
| txt | is the string body of the comment |
References CommentDatabase::addCommentNoDuplicate(), baseaddr, Architecture::commentdb, flags, glb, jumptablerecovery_on, and Comment::warningheader.
Referenced by ActionStackPtrFlow::analyzeExtraPop(), AddTreeState::apply(), ActionRestartGroup::apply(), ActionInferTypes::apply(), ActionPrototypeWarnings::apply(), RuleSwitchSingle::applyOp(), attemptDynamicMappingLate(), blockRemoveInternal(), FlowInfo::checkContainedCall(), FlowInfo::handleOutOfBounds(), hasNoStructBlocks(), FlowInfo::injectPcode(), mapGlobals(), ScopeLocal::markNotMapped(), FlowInfo::processInstruction(), pushMultiequals(), FlowInfo::reinterpreted(), removeUnreachableBlocks(), FuncCallSpecs::resolveSpacebaseRelative(), startProcessing(), and structureReset().
1.8.11